CVE-2026-115373 lxc CVE debrief

Who should care

Defenders managing Incus instances, particularly those with project-restricted clients, should assess exposure and potential impact. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of Incus instances.

Why it matters

CVE-2026-115373 is a high-severity authorization bypass vulnerability in Incus that allows project-restricted clients to read operations in other projects, potentially exposing sensitive information.

• Potential unauthorized access to operations in other projects
• Exposure of command lines, environment secrets, websocket secrets, and trust enrolment tokens
• Need for verification of Incus versions and configurations
• Potential for lateral movement within projects

Technical summary

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. This vulnerability can be exploited by attackers holding a restricted certificate and a known operation UUID, potentially leading to unauthorized access to sensitive information. Defenders should prioritize verifying exposure and assessing potential impact, focusing on project-restricted clients and operations.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on project-restricted clients and operations.

Recommended defensive actions

• Verify Incus versions and configurations to determine exposure
• Assess potential impact on project-restricted clients and operations
• Implement compensating controls to limit unauthorized access
• Monitor for suspicious activity related to operations
• Review vendor advisory for Incus security issue
• Perform exposure review for project-restricted clients
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the authorization bypass vulnerability in Incus, allowing project-restricted clients to read operations in other projects. The vulnerability is caused by a missing authorization check in the GET /1.0/operations/{uuid} endpoint. The source item provides additional context on the affected products and versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.