Bug 2559330 (CVE-2026-115371)
| Summary: | CVE-2026-115371 github.com/lxc/incus: Incus: storage bucket credential disclosure via improper authorization on key endpoints | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Incus. An improper authorization vulnerability allows an authenticated attacker using restricted Transport Layer Security (TLS) client certificates to retrieve storage bucket credentials. By querying the bucket keys endpoints, the attacker can obtain Simple Storage Service (S3) access and secret keys in the default project, potentially allowing unauthorized reading, modification, or deletion of stored data.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2565778 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-22 20:39:13 UTC
|