CVE-2026-115370

MEDIUM 4.3

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services.

CWE	CWE-863
Vendor	lxc
Product	incus
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for lxc incus

Be the first to know when new medium vulnerabilities affecting lxc incus are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

lxc / incus

6.0.5 < 6.0.7 6.12.0 < 7.0.2 7.1.0 < 7.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/lxc/incus/security/advisories/GHSA-443p-7392-h4v2 vulncheck.com: https://www.vulncheck.com/advisories/incus-6.0.5-before-6.0.7-6.12.0-before-7.0.2-and-7.1.0-before-7.5.0-restricted-project-bypass-via-clustered-migration-refresh

Credits

🔍 manus-pi stgraber 🔍 manus-use