Missing Authorization Vulnerability in Incus by LXC

CVE-2026-115373

What is CVE-2026-115373?

Incus versions prior to 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 are susceptible to a missing authorization vulnerability. This issue allows project-restricted clients to access operations beyond their project boundaries. By exploiting this flaw, an attacker can leverage a restricted certificate and a known operation UUID to gain unauthorized access to sensitive information, including command lines, environment secrets, websocket secrets, and trust enrolment tokens. Organizations using Incus should upgrade to the latest versions to mitigate this risk.

References