CVE-2026-115373

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115373", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-22T11:24:28.627Z", "datePublished": "2026-10-22T19:13:43.300Z", "dateUpdated": "2026-10-29T11:57:51.417Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T19:13:43.300Z"}, "datePublic": "2026-09-25T00:00:00.000Z", "title": "Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}", "descriptions": [{"lang": "en", "value": "Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "affected": [{"vendor": "lxc", "product": "incus", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/lxc/incus/v7/cmd/incusd", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "6.0.7"}, {"version": "6.0.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.0", "status": "affected", "versionType": "semver", "lessThan": "7.0.2"}, {"version": "7.0.2", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.0", "status": "affected", "versionType": "semver", "lessThan": "7.5.0"}, {"version": "7.5.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndExcluding": "7.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.0", "versionEndExcluding": "7.5.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-mfwv-x733-9446", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-mfwv-x733-9446)"}, {"name": "VulnCheck Advisory: Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-authorization-bypass-via-get-1.0-operations-uuid"}], "credits": [{"lang": "en", "value": "euriconicacio", "type": "reporter"}, {"lang": "en", "value": "stgraber", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-mfwv-x733-9446", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T11:57:33.199029Z", "id": "CVE-2026-115373", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T11:57:51.417Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115373", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T11:57:33.199029Z"}}}], "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-mfwv-x733-9446", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T11:57:44.907Z"}}], "cna": {"title": "Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}", "credits": [{"lang": "en", "type": "reporter", "value": "euriconicacio"}, {"lang": "en", "type": "finder", "value": "stgraber"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "0", "lessThan": "6.0.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.0.7", "versionType": "semver"}, {"status": "affected", "version": "6.1.0", "lessThan": "7.0.2", "versionType": "semver"}, {"status": "unaffected", "version": "7.0.2", "versionType": "semver"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.5.0", "versionType": "semver"}, {"status": "unaffected", "version": "7.5.0", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/lxc/incus/v7/cmd/incusd", "defaultStatus": "unaffected"}], "datePublic": "2026-09-25T00:00:00.000Z", "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-mfwv-x733-9446", "name": "GitHub Security Advisory (GHSA-mfwv-x733-9446)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-authorization-bypass-via-get-1.0-operations-uuid", "name": "VulnCheck Advisory: Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.7"}, {"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.2", "versionStartIncluding": "6.1.0"}, {"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.5.0", "versionStartIncluding": "7.1.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T19:13:43.300Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115373", "state": "PUBLISHED", "dateUpdated": "2026-10-29T11:57:51.417Z", "dateReserved": "2026-10-22T11:24:28.627Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-22T19:13:43.300Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/lxc/incus/v7/cmd/incusd", "product": "incus", "vendor": "lxc", "versions": [{"lessThan": "6.0.7", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "6.0.7", "versionType": "semver"}, {"lessThan": "7.0.2", "status": "affected", "version": "6.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "7.0.2", "versionType": "semver"}, {"lessThan": "7.5.0", "status": "affected", "version": "7.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "7.5.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens."}], "id": "CVE-2026-115373", "lastModified": "2026-10-29T12:17:11.503", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.0, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115373", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T11:57:33.199029Z", "version": "2.0.3"}}]}, "published": "2026-10-22T19:17:43.813", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/lxc/incus/security/advisories/GHSA-mfwv-x733-9446"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-authorization-bypass-via-get-1.0-operations-uuid"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/lxc/incus/security/advisories/GHSA-mfwv-x733-9446"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/lxc/incus: Incus: Information disclosure via missing authorization check in operations endpoint", "id": "2559365", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559365"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-639", "details": ["Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens.", "A flaw was found in Incus. A missing authorization check on the operations endpoint allows an authenticated attacker with restricted project access to view operations belonging to other projects. By querying the endpoint with a known operation identifier, the attacker can access sensitive information, including environment secrets, command lines, websocket credentials, and trust enrollment tokens."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-115373", "public_date": "2026-10-22T19:13:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115373\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115373\nhttps://github.com/lxc/incus/security/advisories/GHSA-mfwv-x733-9446\nhttps://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-authorization-bypass-via-get-1.0-operations-uuid"], "statement": "This vulnerability is rated as Moderate impact because successful exploitation requires low-privileged network authentication and prior knowledge of a target operation identifier. While unauthorized disclosure of execution parameters and project credentials across tenancy boundaries is serious, the prerequisite of possessing a valid client certificate and discovering an unguessable UUID prevents widespread automated abuse. Furthermore, Incus is not packaged or distributed as part of Red Hat Enterprise Linux, resulting in no direct impact on standard Red Hat deployments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.0.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.0.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.0,7.0.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "7.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1.0,7.5.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "7.5.0"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "incus", "source": "cna", "vendor": "lxc"}, "product": "incus", "vendor": "linuxcontainers"}], "created": "2026-10-23T03:30:15.963664+00:00", "updated": "2026-10-24T02:00:16.884762+00:00", "vendors": ["linuxcontainers", "linuxcontainers$PRODUCT$incus"]}