The vulnerability is an improper authorization flaw (CWE-425) that also leads to unauthorized credential disclosure (CWE-522). It allows an authenticated TLS client with restricted permissions to query bucket keys endpoints and retrieve the S3 access and secret keys for the default project. Possession of those keys permits an attacker to read, modify, or delete objects stored in the affected buckets, effectively exposing sensitive data and enabling destructive changes to storage resources.

All versions of LXC Incus in the LinuxContainers project from 6.0.3 up to and including 6.0.6, from 6.6.0 up to and including 7.0.1, and from 7.1.0 up to and including 7.4.9 are affected when the default project bucket configuration is enabled.

The flaw is rated with a CVSS score of 7.1, indicating high risk, while the EPSS score is less than 1%, suggesting a very low but non‑zero exploitation probability. It is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability remotely by using a TLS client that has restricted but authenticated access, requesting the bucket keys endpoint, and obtaining credentials that bypass normal controls, thereby exposing confidential data or enabling destructive changes.