CVE-2026-115371

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115371", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-22T11:24:28.626Z", "datePublished": "2026-10-22T19:13:41.898Z", "dateUpdated": "2026-11-05T16:18:09.038Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T19:13:41.898Z"}, "datePublic": "2026-09-25T00:00:00.000Z", "title": "LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints", "descriptions": [{"lang": "en", "value": "Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Insufficiently Protected Credentials", "cweId": "CWE-522", "type": "CWE"}]}], "affected": [{"vendor": "lxc", "product": "incus", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/lxc/incus/v7/cmd/incusd", "versions": [{"version": "6.0.3", "status": "affected", "versionType": "semver", "lessThan": "6.0.7"}, {"version": "6.0.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.0", "status": "affected", "versionType": "semver", "lessThan": "7.0.2"}, {"version": "7.0.2", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.0", "status": "affected", "versionType": "semver", "lessThan": "7.5.0"}, {"version": "7.5.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.3", "versionEndExcluding": "6.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.0", "versionEndExcluding": "7.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.0", "versionEndExcluding": "7.5.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-x8gj-2q73-qr6j", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-x8gj-2q73-qr6j)"}, {"name": "VulnCheck Advisory: LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/lxc-incus-6.0.3-before-6.0.7-6.6.0-before-7.0.2-and-7.1.0-before-7.5.0-bucket-credential-disclosure-via-storage-bucket-keys-endpoints"}], "credits": [{"lang": "en", "value": "manus-pi", "type": "reporter"}, {"lang": "en", "value": "stgraber", "type": "finder"}, {"lang": "en", "value": "manus-use", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T16:17:58.611961Z", "id": "CVE-2026-115371", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:18:09.038Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115371", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T16:17:58.611961Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:18:02.878Z"}}], "cna": {"title": "LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints", "credits": [{"lang": "en", "type": "reporter", "value": "manus-pi"}, {"lang": "en", "type": "finder", "value": "stgraber"}, {"lang": "en", "type": "reporter", "value": "manus-use"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "6.0.3", "lessThan": "6.0.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.0.7", "versionType": "semver"}, {"status": "affected", "version": "6.6.0", "lessThan": "7.0.2", "versionType": "semver"}, {"status": "unaffected", "version": "7.0.2", "versionType": "semver"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.5.0", "versionType": "semver"}, {"status": "unaffected", "version": "7.5.0", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/lxc/incus/v7/cmd/incusd", "defaultStatus": "unaffected"}], "datePublic": "2026-09-25T00:00:00.000Z", "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-x8gj-2q73-qr6j", "name": "GitHub Security Advisory (GHSA-x8gj-2q73-qr6j)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/lxc-incus-6.0.3-before-6.0.7-6.6.0-before-7.0.2-and-7.1.0-before-7.5.0-bucket-credential-disclosure-via-storage-bucket-keys-endpoints", "name": "VulnCheck Advisory: LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "Insufficiently Protected Credentials"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.7", "versionStartIncluding": "6.0.3"}, {"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.2", "versionStartIncluding": "6.6.0"}, {"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.5.0", "versionStartIncluding": "7.1.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T19:13:41.898Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115371", "state": "PUBLISHED", "dateUpdated": "2026-11-05T16:18:09.038Z", "dateReserved": "2026-10-22T11:24:28.626Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-22T19:13:41.898Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/lxc/incus/v7/cmd/incusd", "product": "incus", "vendor": "lxc", "versions": [{"lessThan": "6.0.7", "status": "affected", "version": "6.0.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.0.7", "versionType": "semver"}, {"lessThan": "7.0.2", "status": "affected", "version": "6.6.0", "versionType": "semver"}, {"status": "unaffected", "version": "7.0.2", "versionType": "semver"}, {"lessThan": "7.5.0", "status": "affected", "version": "7.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "7.5.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets."}], "id": "CVE-2026-115371", "lastModified": "2026-11-05T17:17:40.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115371", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T16:17:58.611961Z", "version": "2.0.3"}}]}, "published": "2026-10-22T19:17:43.530", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/lxc/incus/security/advisories/GHSA-x8gj-2q73-qr6j"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/lxc-incus-6.0.3-before-6.0.7-6.6.0-before-7.0.2-and-7.1.0-before-7.5.0-bucket-credential-disclosure-via-storage-bucket-keys-endpoints"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/lxc/incus: Incus: storage bucket credential disclosure via improper authorization on key endpoints", "id": "2559330", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559330"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-425", "details": ["Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.", "A flaw was found in Incus. An improper authorization vulnerability allows an authenticated attacker using restricted Transport Layer Security (TLS) client certificates to retrieve storage bucket credentials. By querying the bucket keys endpoints, the attacker can obtain Simple Storage Service (S3) access and secret keys in the default project, potentially allowing unauthorized reading, modification, or deletion of stored data."], "name": "CVE-2026-115371", "public_date": "2026-10-22T19:13:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115371\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115371\nhttps://github.com/lxc/incus/security/advisories/GHSA-x8gj-2q73-qr6j\nhttps://www.vulncheck.com/advisories/lxc-incus-6.0.3-before-6.0.7-6.6.0-before-7.0.2-and-7.1.0-before-7.5.0-bucket-credential-disclosure-via-storage-bucket-keys-endpoints"], "statement": "This vulnerability is rated as Important because authenticated clients with restricted privileges can bypass authorization checks to access sensitive S3 credentials, directly threatening the confidentiality and integrity of stored bucket data. Incus is not distributed or supported in Red Hat Enterprise Linux or other Red Hat container virtualization offerings. Consequently, supported Red Hat products and environments are not affected by this flaw.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "incus", "vendor": "linuxcontainers"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.3,6.0.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.0.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.0,7.0.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "7.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1.0,7.5.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "7.5.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "incus", "source": "cna", "vendor": "lxc"}, "product": "incus", "vendor": "lxc"}], "created": "2026-10-23T03:45:16.531027+00:00", "updated": "2026-11-04T12:00:17.121230+00:00", "vendors": ["linuxcontainers", "linuxcontainers$PRODUCT$incus", "lxc", "lxc$PRODUCT$incus"]}