CVE-2026-115370

EUVD-2026-108293
Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 21.45%
Debian logo
Debian Releases
Debian Product
Codename
incus
forky
7.0.1-5
fixed
sid
7.0.2-2
fixed
trixie
6.0.4-2+deb13u10
fixed
trixie (security)
6.0.4-2+deb13u11
fixed
Common Weakness Enumeration
References
https://github.com/lxc/incus/security/advisories/GHSA-443p-7392-h4v2
https://www.vulncheck.com/advisories/incus-6.0.5-before-6.0.7-6.12.0-before-7.0.2-and-7.1.0-before-7.5.0-restricted-project-bypass-via-clustered-migration-refresh