CVE-2026-115370

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115370", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-22T11:24:28.626Z", "datePublished": "2026-10-22T19:13:41.181Z", "dateUpdated": "2026-10-23T15:01:52.150Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T19:13:41.181Z"}, "datePublic": "2026-09-25T00:00:00.000Z", "title": "Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh", "descriptions": [{"lang": "en", "value": "Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "affected": [{"vendor": "lxc", "product": "incus", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/lxc/incus/v7/cmd/incusd", "versions": [{"version": "6.0.5", "status": "affected", "versionType": "semver", "lessThan": "6.0.7"}, {"version": "6.0.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.0", "status": "affected", "versionType": "semver", "lessThan": "7.0.2"}, {"version": "7.0.2", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.0", "status": "affected", "versionType": "semver", "lessThan": "7.5.0"}, {"version": "7.5.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.5", "versionEndExcluding": "6.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.0", "versionEndExcluding": "7.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.0", "versionEndExcluding": "7.5.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-443p-7392-h4v2", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-443p-7392-h4v2)"}, {"name": "VulnCheck Advisory: Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/incus-6.0.5-before-6.0.7-6.12.0-before-7.0.2-and-7.1.0-before-7.5.0-restricted-project-bypass-via-clustered-migration-refresh"}], "credits": [{"lang": "en", "value": "manus-pi", "type": "reporter"}, {"lang": "en", "value": "stgraber", "type": "finder"}, {"lang": "en", "value": "manus-use", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-23T14:48:23.779055Z", "id": "CVE-2026-115370", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-23T15:01:52.150Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115370", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-23T14:48:23.779055Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-23T14:48:24.617Z"}}], "cna": {"title": "Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh", "credits": [{"lang": "en", "type": "reporter", "value": "manus-pi"}, {"lang": "en", "type": "finder", "value": "stgraber"}, {"lang": "en", "type": "reporter", "value": "manus-use"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "6.0.5", "lessThan": "6.0.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.0.7", "versionType": "semver"}, {"status": "affected", "version": "6.12.0", "lessThan": "7.0.2", "versionType": "semver"}, {"status": "unaffected", "version": "7.0.2", "versionType": "semver"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.5.0", "versionType": "semver"}, {"status": "unaffected", "version": "7.5.0", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/lxc/incus/v7/cmd/incusd", "defaultStatus": "unaffected"}], "datePublic": "2026-09-25T00:00:00.000Z", "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-443p-7392-h4v2", "name": "GitHub Security Advisory (GHSA-443p-7392-h4v2)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/incus-6.0.5-before-6.0.7-6.12.0-before-7.0.2-and-7.1.0-before-7.5.0-restricted-project-bypass-via-clustered-migration-refresh", "name": "VulnCheck Advisory: Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.7", "versionStartIncluding": "6.0.5"}, {"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.2", "versionStartIncluding": "6.12.0"}, {"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.5.0", "versionStartIncluding": "7.1.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T19:13:41.181Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115370", "state": "PUBLISHED", "dateUpdated": "2026-10-23T15:01:52.150Z", "dateReserved": "2026-10-22T11:24:28.626Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-22T19:13:41.181Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/lxc/incus/v7/cmd/incusd", "product": "incus", "vendor": "lxc", "versions": [{"lessThan": "6.0.7", "status": "affected", "version": "6.0.5", "versionType": "semver"}, {"status": "unaffected", "version": "6.0.7", "versionType": "semver"}, {"lessThan": "7.0.2", "status": "affected", "version": "6.12.0", "versionType": "semver"}, {"status": "unaffected", "version": "7.0.2", "versionType": "semver"}, {"lessThan": "7.5.0", "status": "affected", "version": "7.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "7.5.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services."}], "id": "CVE-2026-115370", "lastModified": "2026-10-23T17:06:36.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115370", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-23T14:48:23.779055Z", "version": "2.0.3"}}]}, "published": "2026-10-22T19:17:43.387", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/lxc/incus/security/advisories/GHSA-443p-7392-h4v2"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/incus-6.0.5-before-6.0.7-6.12.0-before-7.0.2-and-7.1.0-before-7.5.0-restricted-project-bypass-via-clustered-migration-refresh"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/lxc/incus: Incus: Security restriction bypass via clustered migration refresh requests", "id": "2559304", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559304"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services.", "A flaw was found in Incus. An authenticated user with instance creation privileges in a restricted project can bypass security restrictions by submitting a clustered refresh migration request for an existing instance. This allows the attacker to force the server to establish outbound TLS (Transport Layer Security) WebSocket connections, enabling them to probe network services reachable by the server."], "name": "CVE-2026-115370", "public_date": "2026-10-22T19:13:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115370\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115370\nhttps://github.com/lxc/incus/security/advisories/GHSA-443p-7392-h4v2\nhttps://www.vulncheck.com/advisories/incus-6.0.5-before-6.0.7-6.12.0-before-7.0.2-and-7.1.0-before-7.5.0-restricted-project-bypass-via-clustered-migration-refresh"], "statement": "This vulnerability has been rated as Moderate because successful exploitation requires pre-existing authenticated credentials with instance creation permissions, and the impact is confined to network reconnaissance without unauthorized data modification. Furthermore, Incus is not packaged or distributed within supported Red Hat Enterprise Linux environments or core container offerings. In environments where Incus is deployed independently, the risk remains restricted because attackers cannot execute code or directly alter cluster state through this mechanism.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.5,6.0.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.0.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.0,7.0.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "7.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1.0,7.5.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "7.5.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "incus", "source": "cna", "vendor": "lxc"}, "product": "incus", "vendor": "linuxcontainers"}], "created": "2026-10-23T03:45:16.531165+00:00", "updated": "2026-11-04T11:30:10.350158+00:00", "vendors": ["linuxcontainers", "linuxcontainers$PRODUCT$incus"]}