HIGHCVSS v3.1 7.1Vulnerability
CVE-2026-115371
Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-10-22T22:14:18.200859+00:00
- Cvss severity
- HIGH
- Cvss score
- 7.1
- Retrieved at
- 2026-10-22T22:16:40+00:00
- Score
- 7.1
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-115371
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- First seen by Signal
- 2026-10-22T22:12:23+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- Published at
- 2026-10-22T19:17:43.530
- Last modified
- 2026-10-22T19:17:43.530
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph