p PatchFirst

CVE-2026-115373

CVE-2026-115373 · Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens.

CVSS 7.0 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • incus

    Versions
    • ≥ 0, < 6.0.7: Affected (semver)
    • 6.0.7: Not affected (semver)
    • ≥ 6.1.0, < 7.0.2: Affected (semver)
    • 7.0.2: Not affected (semver)
    • ≥ 7.1.0, < 7.5.0: Affected (semver)
    • 7.5.0: Not affected (semver)

    Update to 6.0.7; Update to 7.0.2; Update to 7.5.0

  • incus Debian:13

    Versions
    • 6.0.4-2
    • 6.0.4-2+deb13u1
    • 6.0.4-2+deb13u10
    • 6.0.4-2+deb13u1~bpo12+1
    • 6.0.4-2+deb13u2
    • 6.0.4-2+deb13u2~bpo12+1
    • 6.0.4-2+deb13u3
    • 6.0.4-2+deb13u3~bpo12+1
    • 6.0.4-2+deb13u4
    • 6.0.4-2+deb13u4~bpo12+1
    • 6.0.4-2+deb13u5
    • 6.0.4-2+deb13u5~bpo12+1
    • 6.0.4-2+deb13u6
    • 6.0.4-2+deb13u6~bpo12+1
    • 6.0.4-2+deb13u7
    • 6.0.4-2+deb13u7~bpo12+1
    • 6.0.4-2+deb13u8
    • 6.0.4-2+deb13u9
    Affected ranges
    • ECOSYSTEM: < 6.0.4-2+deb13u11

    Update to 6.0.4-2+deb13u11

  • incus Debian:14

    Versions
    • 6.0.4-2
    • 6.0.4-3
    • 6.0.5-1
    • 6.0.5-2
    • 6.0.5-3
    • 6.0.5-4
    • 6.0.5-5
    • 6.0.5-6
    • 6.0.5-7
    • 6.0.5-8
    • 6.0.6-1
    • 6.0.6-2
    • 6.0.6-3
    • 6.14.0-1~exp1
    • 6.15.0-1~exp1
    • 6.16.0-1~exp1
    • 6.17.0-1~exp1
    • 6.20.0-1~exp1
    • 6.21.0-1~exp1
    • 6.22.0-1~exp1
    • 6.23.0-1~exp1
    • 7.0.0-1
    • 7.0.0-1~bpo13+1
    • 7.0.0-2
    • 7.0.0-2~bpo13+1
    • 7.0.0-3
    • 7.0.0-4
    • 7.0.0-5
    • 7.0.0-5~bpo13+1
    • 7.0.1-1
    • 7.0.1-1~bpo13+1
    • 7.0.1-2
    • 7.0.1-2~bpo13+1
    • 7.0.1-3
    • 7.0.1-3~bpo13+1
    • 7.0.1-4
    • 7.0.1-5~bpo13+1
    Affected ranges
    • ECOSYSTEM: < 7.0.1-5

    Update to 7.0.1-5

Original sources

Check your server →