{
  "cveId": "CVE-2026-115371",
  "url": "https://patchblox.com/security/cve/CVE-2026-115371",
  "summary": "CVE-2026-115371 is fixed in incus on 1 platform, first by DEBIAN-CVE-2026-115371, released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "incus: Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability...",
  "description": "Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.",
  "published": "2026-10-22T19:17:43Z",
  "severity": "",
  "epss": 0.00219,
  "epssPercentile": 0.12512,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "incus",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.4-2\u002Bdeb13u11",
      "fix": "DEBIAN-CVE-2026-115371",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-115371",
      "released": "2026-10-24T13:25:57Z"
    },
    {
      "platform": "linux",
      "product": "incus",
      "release": "Debian 14",
      "fixedVersion": "7.0.1-5",
      "fix": "DEBIAN-CVE-2026-115371",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-115371",
      "released": "2026-10-24T13:25:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}