CVE catalog

CVE-2026-115373

UBUNTU-CVE-2026-115373

[CVE catalog]

Severity
Unknown · CVSS 6.3CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.21% · Oct 25, 2026

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianincus136.0.4-2vulnerable
Debianincus136.0.4-2+deb13u1vulnerable
Debianincus136.0.4-2+deb13u10vulnerable
Debianincus136.0.4-2+deb13u1~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u2vulnerable
Debianincus136.0.4-2+deb13u2~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u3vulnerable
Debianincus136.0.4-2+deb13u3~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u4vulnerable
Debianincus136.0.4-2+deb13u4~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u5vulnerable
Debianincus136.0.4-2+deb13u5~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u6vulnerable
Debianincus136.0.4-2+deb13u6~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u7vulnerable
Debianincus136.0.4-2+deb13u7~bpo12+1vulnerable
Debianincus136.0.4-2+deb13u8vulnerable
Debianincus136.0.4-2+deb13u9vulnerable
Debianincus136.0.4-2+deb13u11fixed
Debianincus146.0.4-2vulnerable
Debianincus146.0.4-3vulnerable
Debianincus146.0.5-1vulnerable
Debianincus146.0.5-2vulnerable
Debianincus146.0.5-3vulnerable
Debianincus146.0.5-4vulnerable
Debianincus146.0.5-5vulnerable
Debianincus146.0.5-6vulnerable
Debianincus146.0.5-7vulnerable
Debianincus146.0.5-8vulnerable
Debianincus146.0.6-1vulnerable
Debianincus146.0.6-2vulnerable
Debianincus146.0.6-3vulnerable
Debianincus146.14.0-1~exp1vulnerable
Debianincus146.15.0-1~exp1vulnerable
Debianincus146.16.0-1~exp1vulnerable
Debianincus146.17.0-1~exp1vulnerable
Debianincus146.20.0-1~exp1vulnerable
Debianincus146.21.0-1~exp1vulnerable
Debianincus146.22.0-1~exp1vulnerable
Debianincus146.23.0-1~exp1vulnerable
Debianincus147.0.0-1vulnerable
Debianincus147.0.0-1~bpo13+1vulnerable
Debianincus147.0.0-2vulnerable
Debianincus147.0.0-2~bpo13+1vulnerable
Debianincus147.0.0-3vulnerable
Debianincus147.0.0-4vulnerable
Debianincus147.0.0-5vulnerable
Debianincus147.0.0-5~bpo13+1vulnerable
Debianincus147.0.1-1vulnerable
Debianincus147.0.1-1~bpo13+1vulnerable
Debianincus147.0.1-2vulnerable
Debianincus147.0.1-2~bpo13+1vulnerable
Debianincus147.0.1-3vulnerable
Debianincus147.0.1-3~bpo13+1vulnerable
Debianincus147.0.1-4vulnerable
Debianincus147.0.1-5~bpo13+1vulnerable
Debianincus147.0.1-5fixed
Ubuntuincuspro6.0.4-2vulnerable
Ubuntuincuspro6.0.5-8vulnerable
Ubuntuincuspro6.0.5-8ubuntu0.26.04.1~esm1vulnerable
Ubuntuincus26.106.0.5-8vulnerable
Ubuntuincus26.107.0.1-5vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianincusdeb136.0.4-2+deb13u11Not reportedDEBIAN-CVE-2026-115373Not reported
Debianincusdeb147.0.1-5Not reportedDEBIAN-CVE-2026-115373Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [golang-github-lxc-incus-dev]Affected

    Source package: [incus]

    Details (7)

    • 6.0.4-2+deb13u8 · all · trixie

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u8 · all · trixie

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u11 · all · trixie-security

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · all · trixie-security

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · all · trixie-security · Historical version

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

  • [incus]Affected
    Details (7)

    • 6.0.4-2+deb13u8 · amd64 · trixie

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u8 · arm64 · trixie

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u11 · amd64 · trixie-security

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · arm64 · trixie-security

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

  • [incus-agent]Affected

    Source package: [incus]

    Details (7)

    • 6.0.4-2+deb13u8 · amd64 · trixie

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u8 · arm64 · trixie

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u11 · amd64 · trixie-security

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · arm64 · trixie-security

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

  • [incus-base]Affected

    Source package: [incus]

    Details (7)

    • 6.0.4-2+deb13u8 · amd64 · trixie

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u8 · arm64 · trixie

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u11 · amd64 · trixie-security

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · arm64 · trixie-security

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

  • [incus-client]Affected

    Source package: [incus]

    Details (7)

    • 6.0.4-2+deb13u8 · amd64 · trixie

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u8 · arm64 · trixie

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u11 · amd64 · trixie-security

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · arm64 · trixie-security

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

  • [incus-extra]Affected

    Source package: [incus]

    Details (7)

    • 6.0.4-2+deb13u8 · amd64 · trixie

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u8 · arm64 · trixie

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 7.0.1-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u11 · amd64 · trixie-security

      Fixed · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

    • 6.0.4-2+deb13u9 · arm64 · trixie-security

      Affected · Fixed: 6.0.4-2+deb13u11

      pypi · incus · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]