EUVD-2026-108294

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read...

CVE-2026-115371

The Incus software versions 6.0.3 before 6.0.7 , 6.6.0 before 7.0.2 , and 7.1.0 before 7.5.0 are vulnerable to an improper authorization flaw. This vulnerability allows restricted TLS clients to access and read storage bucket keys within the default project. By querying these bucket keys endpoint...