Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: lxc incus 7.0.2, 7.5.0 Clear all filters
TI-2026-79461 CVE-2026-115376 · GHSA-c5q4-rxv3-w923

Incus lets restricted clients copy volumes from other projects

Priority LOW 36

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00273 Published 2026-10-22 Fixed in 7.0.2, 7.5.0 CWE-284
TI-2026-79460 CVE-2026-115375 · GHSA-f963-f2v2-v6x5

Path traversal in Incus lets clients write files on the host

Priority MEDIUM 43

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00405 Published 2026-10-22 Fixed in 7.0.2, 7.5.0 CWE-22
TI-2026-79459 CVE-2026-115374 · GHSA-m6pj-594x-rw4f

Signature bypass in Incus S3 presigned uploads exposes other objects

Priority LOW 30

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00183 Published 2026-10-22 Fixed in 7.0.2, 7.5.0 CWE-347