CVE-2026-109797

In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenan...

CVE-2026-109797

In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenan...

CVE-2026-109797

In SAP/astonish , an authenticated user can identify and operate on another team's sandbox containers due to improper tenant isolation in the legacy Incus sandbox-management API handlers . The root cause is that these handlers fail to use the tenant-aware session lookup path , enabling cross-tena...

EUVD-2026-120705

In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenan...

CVE-2026-109797 Cross-tenant sandbox takeover in SAP/astonish

In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenan...

CVE-2026-109797 Cross-tenant sandbox takeover in SAP/astonish

In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenan...

CVE-2026-109797 Cross-tenant sandbox takeover in SAP/astonish

In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenan...

PT-2026-141289

In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenan...

CVE-2026-109797: SAP_SE SAP/astonish: In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers…

In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenan...

LXD has arbitrary file write on client due to trusted image hash

Reported from https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x Summary An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Details -...

LXD has argument injection in backup compression algorithm leading to AFW and ACE

Reported from https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 Summary Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrar...

LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details Incus validates an image as soon as it sees a normal...

CVE-2026-115376

A flaw was found in Incus. An authorization bypass allows authenticated, project-restricted users to gain unauthorized access to data belonging to other projects. By submitting a crafted volume copy request that omits the source volume type, an attacker can duplicate and inspect another project's...

CVE-2026-115370

A flaw was found in Incus. An authenticated user with instance creation privileges in a restricted project can bypass security restrictions by submitting a clustered refresh migration request for an existing instance. This allows the attacker to force the server to establish outbound TLS Transpor...

CVE-2026-115375

A flaw was found in Incus. An authenticated user with instance creation privileges can exploit a path traversal vulnerability by importing a crafted instance backup archive containing directory traversal sequences in dependent volume names. Successful exploitation allows the attacker to escape...

CVE-2026-115371

A flaw was found in Incus. An improper authorization vulnerability allows an authenticated attacker using restricted Transport Layer Security TLS client certificates to retrieve storage bucket credentials. By querying the bucket keys endpoints, the attacker can obtain Simple Storage Service S3...

[SECURITY] [DSA 6604-1] incus security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6604-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 02, 2026 https://www.debian.org/security/faq -...

Incus Container File Path Traversal

The vulnerability in the Incus container management system and virtual machine manager is related to improper external handling of file name or path. Exploitation of this vulnerability may allow a remote attacker to gain read and modify access...

Incus Container Management DoS

The vulnerability in the Incus container management system and virtual machine manager is related to flaws in its authorization mechanism. Exploitation of this vulnerability could allow a remote attacker to bypass security restrictions and cause a denial of service...

container management system Block Create Options Command Execution

The vulnerability in the block.createoptions mechanism of the container management system and the Incus virtual machine manager is related to argument injection or modification. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary commands...