Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Critical | 9.4 | CVE-2026-115377 |
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by...
lxc, Rsync, Incuslxc incus, Rsync, Incus, incusd, btrfs receive
|
NVD | |||
|
CVE-2026-115377Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by...
Executive summaryA flaw in Incus, a system container and virtual machine manager, lets a malicious migration source or a client allowed to create instances write arbitrary files to the host as root, which can lead to full host compromise. The advisory rates it Critical with a CVSS 3.1 base score of 9.9. The fixed releases named are Incus 6.0.7, 7.0.2, and 7.5.0, depending on the branch. Technical summaryThe weakness is CWE-59, improper link resolution before file access, where symlinks in a migration stream are followed when Incus replays the stream with rsync or btrfs receive. Exploitation requires network-reachable access as a client allowed to create instances or custom volumes in a project, or a malicious source server the target copies or moves from, with low privileges and no user interaction. The advisory states that releases before 7.3.0 are additionally affected by a rootfs symlink surviving the transfer, which can allow host files to be read. Affected versions are listed as before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0, and the GitHub package entry lists patched versions as 7.5.0 or later. The advisory does not state workarounds beyond restricting instance creation and migration to trusted clients and servers, and it does not state detection guidance or whether the flaw is exploited in the wild. Optimized ZFS transfers are stated to be unaffected. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-579w-c4rw-c8q3 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.3 | CVE-2026-115376 |
Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type
lxc, Incuslxc incus, Incus, incusd
|
NVD | |||
|
CVE-2026-115376Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type
Executive summaryIncus, a container and virtual machine management platform, has an authorization flaw that lets a client restricted to one project copy storage volumes from other projects on the same server. The advisory rates it High, with a CVSS v3.1 base score of 7.7. The fix is to upgrade to version 7.5.0 or later. Technical summaryThis is an improper access control flaw (CWE-284). The source volume access check runs only when source.type is explicitly set to copy, so a crafted request to POST /1.0/storage-pools/{pool}/volumes/custom that omits source.type bypasses it and reaches the copy path with a caller-controlled source.project. The attack requires network access and low privileges, specifically permission to create custom volumes in a project, and no user interaction. The advisory says the official client always sets source.type to copy, so exploitation requires a crafted request. Affected versions are stated as 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0, with patched versions at 7.5.0 or later. No workaround is stated, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-jh4v-j34r-2mgh Impact if exploitedConfidentialityHigh IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-115374 |
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-*...
lxc, Incuslxc incus, Incus, incusd
|
NVD | |||
|
CVE-2026-115374Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-*...
Executive summaryIncus, a container and virtual machine management platform, has a flaw in its built-in S3 storage server that lets someone holding a single presigned upload link read other objects in the same bucket. The advisory rates the issue High, with a CVSS v3.1 base score of 7.1, and the fix is to upgrade to version 7.5.0 or later, or to avoid handing out presigned URLs for sensitive buckets. Technical summaryThe flaw is an improper verification of cryptographic signatures (CWE-347) in the in-process S3 server used for storage buckets on local storage pools. SigV4 checks cover only the headers the client lists as signed, so unsigned x-amz-* headers such as X-Amz-Copy-Source are accepted and can turn a write grant into a copy that reads another object in the bucket. The attack needs only a presigned URL for one object, with no bucket credentials, and the vector is network-based with low privileges required. The advisory states affected versions as Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0, with patched version v7.5.0 or later for the Go package. Ceph radosgw buckets are not affected, and the bucket listener is disabled by default. The advisory gives the workaround of not issuing presigned URLs for buckets holding sensitive objects or keeping the listener disabled. No detection guidance and no exploitation-in-the-wild information are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-mmj7-8rgf-mx2h Impact if exploitedConfidentialityHigh IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.0 | CVE-2026-115373 |
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients...
lxc, Incuslxc incus, Incus, incusd
|
NVD | |||
|
CVE-2026-115373Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients...
Executive summaryThe advisory says that Incus, a container and virtual machine manager, lets a client with a certificate restricted to one project read details of running operations in other projects, including command lines, environment variables and websocket secrets. The attacker must already know the operation's UUID, and the advisory rates the issue Moderate with a CVSS 3.1 base score of 6.3 Medium. The advisory describes a fix that adds an authorization check to the operation read handler, and it does not state a fixed version number for this single flaw beyond the affected-version ranges given. Technical summaryThis is a missing authorization flaw (CWE-862) in the GET /1.0/operations/{uuid} handler, which performs no project-level permission check while the delete and list handlers do. The attack requires a valid enrolled client certificate and the target operation's UUID, which the advisory says must be obtained out of band, and no victim interaction is needed after that. The advisory states affected versions as before 6.0.7, 6.1.0 through 7.0.2, and 7.1.0 through 7.5.0, with the patched version given as v7.5.0 and the package github.com/lxc/incus/v7/cmd/incusd. The advisory does not state a specific workaround, and it does not state any detection guidance or any exploitation in the wild. The suggested fix adds a CanViewOperations check on the operation's project to operationGet, and the advisory notes that operationWaitGet may need the same treatment but has not been tested. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-mfwv-x733-9446 Impact if exploitedConfidentialityHigh IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-115371 |
Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket...
lxc, Incuslxc incus, Incus, incusd
|
NVD | |||
|
CVE-2026-115371Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket...
Executive summaryA flaw in Incus, a container and virtual machine management system, lets a client with a restricted TLS certificate read the access and secret keys for storage buckets in the default project. The advisory rates it High with a CVSS score of 8.5, and the fix is to upgrade to a patched version or move affected buckets out of the default project. Technical summaryThe flaw is an improper authorization issue, classified as CWE-522 (insufficiently protected credentials). The bucket key endpoints under /1.0/storage-pools/{pool}/buckets/{bucket}/keys only required can_view permission, and the TLS authorizer grants restricted client certificates read-only access to buckets in the default project, which exposes S3 access and secret keys. Affected versions are stated as 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0, with the GHSA advisory giving Go package affected versions as less than v7.5.0 and patched versions as v7.5.0 or later. The attack requires a restricted TLS client certificate scoped to any project, and only the TLS authorizer is affected, not OpenFGA deployments. The fix requires can_edit on the bucket for key retrieval, and the advisory gives the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N with a score of 8.5. The workaround is to avoid keeping buckets in the default project on servers issuing restricted certificates, or to rotate the keys of any bucket a restricted client may have read. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/lxc/incus/security/advisories/GHSA-x8gj-2q73-qr6j Impact if exploitedConfidentialityHigh IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||