medium6.3
CVE-2026-115373
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-r…
Impact
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens.
Affected products
| Product | Affected versions |
|---|---|
| Incus | before 6.0.7 |
| 6.1.0 | before 7.0.2 |
| And 7.1.0 | before 7.5.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.