Skip to content
Sign in
5.3 Medium

CVE-2026-115370 Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that…

Description

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services.

Affected products and versions

Product Affected versions Fixed in
incus 7.5 earliest → < 7.5.0 7.5.0
incus 7.1 7.1.0 → < 7.5.0 7.5.0
incus 7.0 earliest → < 7.0.2 7.0.2
incus 6.12 6.12.0 → < 7.0.2 7.0.2
incus 6.0 6.0.5 → < 6.0.7 6.0.7

Other CVEs of incus

The 47 CVEs of incus →
CVE-2026-115378 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in… 6.9 Medium CVE-2026-115377 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that… 9.4 Critical CVE-2026-115376 Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows… 8.3 High CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes 9.4 Critical
Track this CVE