---
id: CVE-2026-115371
title: >-
  LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0
  Bucket Credential Disclosure via Storage Bucket Keys Endpoints
summary: >-
  Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains
  an improper authorization vulnerability that allows restricted TLS clients to
  read storage bucket keys in the default project. Attackers can query the
  bucket k…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-522
vendor: lxc
product: incus
affected:
  - incus >= 6.0.3 < 6.0.7
  - incus >= 6.6.0 < 7.0.2
  - incus >= 7.1.0 < 7.5.0
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:13:41.898Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115371'
references:
  - url: 'https://github.com/lxc/incus/security/advisories/GHSA-x8gj-2q73-qr6j'
    label: GitHub Security Advisory (GHSA-x8gj-2q73-qr6j)
  - url: >-
      https://www.vulncheck.com/advisories/lxc-incus-6.0.3-before-6.0.7-6.6.0-before-7.0.2-and-7.1.0-before-7.5.0-bucket-credential-disclosure-via-storage-bucket-keys-endpoints
    label: >-
      VulnCheck Advisory: LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and
      7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys
      Endpoints
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.401Z'
---

## Overview

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.

## Affected

- `incus >= 6.0.3 < 6.0.7`
- `incus >= 6.6.0 < 7.0.2`
- `incus >= 7.1.0 < 7.5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.