CVE-2026-115371: incus 6.0.3 to before 6.0.7, 6.6.0 to before 7.0.2, 7.1.0 to before 7.5.0

Affected technology

incus · 6.0.3 to before 6.0.7, 6.6.0 to before 7.0.2, 7.1.0 to before 7.5.0
lxc

Description’s affected range: before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as high; integrity impact as low; availability impact as none.