Incus CVE-2026-115370

Requires a CLUSTERED Incus server (standalone servers are explicitly NOT affected per the vendor); an authenticated user who has been granted instance-creation rights inside a RESTRICTED project; and an instance that already exists locally and is owned by that user, against which the attacker sends a migration request with 'refresh' set. The exploit is limited to making the server open outbound TLS websocket connections and probe reachable services - the vendor states the refresh only synchronizes storage for an instance the user already owns, so no configuration or access bypass results. The primary limiting factors are the clustered-only requirement, the need for an administratively granted instance-creation role in a restricted project, and the bounded SSRF-only impact. Affected versions: 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0.

This is a moderate-severity authorization bypass with a server-side request forgery (SSRF) outcome, and the available signals are internally consistent rather than conflicting. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 and correctly reflects a network-reachable but privilege-requiring issue with only low confidentiality impact. The GHSA advisory adds CWE-918 (SSRF) alongside CWE-863 (improper authorization), confirming the mechanism: a restricted-project user with instance-creation rights can coerce the server into opening outbound TLS websocket connections to attacker-chosen URLs and probe reachable services. No EPSS score was provided (treat exploitation probability as unknown), the CVE is NOT on CISA KEV, and the references are vendor/coordinator advisories rather than verified exploit code - so there is no confirmed active exploitation and no confirmed working PoC. The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with the signal set: real but bounded. The PR:L requirement, the clustered-only precondition, and the limited impact (probing/SSRF, with no configuration or data bypass per the vendor) place this well below the 'drop everything' tier while still warranting patching in a normal cycle. Key limiting fact stated by the vendor: standalone (non-clustered) servers are not affected at all.

On a clustered Incus deployment, a tenant who has been granted instance-creation rights within a restricted project sends a migration request with 'refresh' set for an instance they already own. The clustered refresh path short-circuits past the pull-mode restriction check, causing the Incus server to open an outbound TLS websocket to an attacker-supplied URL (trusting an attacker-supplied certificate), which the attacker uses to probe internal services reachable from the server. No public working exploit code is identified at time of analysis; only vendor and coordinator advisories exist.