CVE-2026-115370: Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh

Q: Who can exploit this issue?

A user in a restricted project who has permission to create instances can exploit it. The attacker must be able to submit a clustered refresh migration request for an existing instance.

Q: What can an attacker do with a successful exploit?

The attacker can cause the Incus server to open outbound TLS WebSocket connections and probe services reachable from that server. The stated impact is limited to confidentiality; no integrity or availability impact is specified.

Q: Which releases are affected and which releases contain fixes?

Affected version ranges are Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0. Updating to 6.0.7, 7.0.2, or 7.5.0, as applicable, addresses the issue.

Q: What can be done if updating is not immediately possible?

Limit instance-creation rights for users in restricted projects, because those rights are required for exploitation. Restricting their ability to submit clustered refresh migration requests also prevents the described attack path, if operationally feasible.

Published Oct 22, 2026

Updated

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services.

Affected Software

1 affected component

Linux Containers Incus>=6.0.5<6.0.7, >=6.12.0<7.0.2, >=7.1.0<7.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Incus to a version that resolves this vulnerability.
Fixed in 6.0.7
Upgrade
Upgrade Incus to a version that resolves this vulnerability.
Fixed in 7.0.2
Upgrade
Upgrade Incus to a version that resolves this vulnerability.
Fixed in 7.5.0

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A user in a restricted project who has permission to create instances can exploit it. The attacker must be able to submit a clustered refresh migration request for an existing instance.

What can an attacker do with a successful exploit?

The attacker can cause the Incus server to open outbound TLS WebSocket connections and probe services reachable from that server. The stated impact is limited to confidentiality; no integrity or availability impact is specified.

Which releases are affected and which releases contain fixes?

Affected version ranges are Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0. Updating to 6.0.7, 7.0.2, or 7.5.0, as applicable, addresses the issue.

What can be done if updating is not immediately possible?

Limit instance-creation rights for users in restricted projects, because those rights are required for exploitation. Restricting their ability to submit clustered refresh migration requests also prevents the described attack path, if operationally feasible.

CVE-2026-115370: Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do with a successful exploit?

Which releases are affected and which releases contain fixes?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do with a successful exploit?

Which releases are affected and which releases contain fixes?

What can be done if updating is not immediately possible?