CVE-2026-115370 Details

A restriction bypass vulnerability has been identified in Incus versions 6.0.5 prior to 6.0.7, 6.12.0 prior to 7.0.2, and 7.1.0 prior to 7.5.0. This vulnerability allows users with restricted project access to bypass limitations and use pull mode migration through clustered refresh requests. Attackers with instance creation rights can exploit this by sending a refresh migration request for an existing instance, causing the server to establish outbound TLS WebSocket connections to a user-specified URL and probe accessible services. The issue arises because the migration request bypasses the instance creation check on clustered servers, allowing unauthorized outbound connections.

Users should avoid granting instance creation rights in restricted projects on clustered servers to individuals who should not be able to initiate outbound connections from the server.