p PatchFirst

CVE-2026-115370

CVE-2026-115370 · Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services.

CVSS 5.3 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • incus

    Versions
    • ≥ 6.0.5, < 6.0.7: Affected (semver)
    • 6.0.7: Not affected (semver)
    • ≥ 6.12.0, < 7.0.2: Affected (semver)
    • 7.0.2: Not affected (semver)
    • ≥ 7.1.0, < 7.5.0: Affected (semver)
    • 7.5.0: Not affected (semver)

    Update to 6.0.7; Update to 7.0.2; Update to 7.5.0

  • incus Debian:14

    Versions
    • 6.0.4-2
    • 6.0.4-3
    • 6.0.5-1
    • 6.0.5-2
    • 6.0.5-3
    • 6.0.5-4
    • 6.0.5-5
    • 6.0.5-6
    • 6.0.5-7
    • 6.0.5-8
    • 6.0.6-1
    • 6.0.6-2
    • 6.0.6-3
    • 6.14.0-1~exp1
    • 6.15.0-1~exp1
    • 6.16.0-1~exp1
    • 6.17.0-1~exp1
    • 6.20.0-1~exp1
    • 6.21.0-1~exp1
    • 6.22.0-1~exp1
    • 6.23.0-1~exp1
    • 7.0.0-1
    • 7.0.0-1~bpo13+1
    • 7.0.0-2
    • 7.0.0-2~bpo13+1
    • 7.0.0-3
    • 7.0.0-4
    • 7.0.0-5
    • 7.0.0-5~bpo13+1
    • 7.0.1-1
    • 7.0.1-1~bpo13+1
    • 7.0.1-2
    • 7.0.1-2~bpo13+1
    • 7.0.1-3
    • 7.0.1-3~bpo13+1
    • 7.0.1-4
    • 7.0.1-5~bpo13+1
    Affected ranges
    • ECOSYSTEM: < 7.0.1-5

    Update to 7.0.1-5

  • incus Ubuntu:Pro:24.04:LTS

    Versions
    • 0.4-1ubuntu1
    • 0.5.1-1
    • 0.5.1-3
    • 0.6-1
    • 6.0.0-1
    • 6.0.0-1ubuntu0.1
    • 6.0.0-1ubuntu0.2
    • 6.0.0-1ubuntu0.2+esm1
    • 6.0.0-1ubuntu0.3
    • 6.0.0-1ubuntu0.3+esm1
    • 6.0.0-1ubuntu0.3+esm2
    • 6.0.0-1ubuntu0.3+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • incus Ubuntu:26.10

    Versions
    • 6.0.5-8
    • 7.0.1-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • incus Ubuntu:Pro:26.04:LTS

    Versions
    • 6.0.4-2
    • 6.0.5-8
    • 6.0.5-8ubuntu0.26.04.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →