Incus 6.0.3 through 6.0.6, 6.6.0 through 7.0.1, and 7.1.0 through 7.4.9 contains an improper authorization flaw. The flaw allows an authenticated TLS client with restricted permissions to query bucket keys endpoints and retrieve S3 access and secret keys for the default project. Possession of these credentials permits an attacker to read, modify, or delete objects stored in the affected buckets, effectively exposing sensitive data and enabling destructive changes.

The vulnerability is specific to the LXC Incus container engine. Versions 6.0.3 through 6.0.6 inclusive, 6.6.0 through 7.0.1 inclusive, and 7.1.0 through 7.4.9 inclusive are affected. All LXC Incus products in the LinuxContainers project with the default project bucket configuration are susceptible.

The flaw has a CVSS score of 7.1, indicating high risk, while the EPSS score is not available so the current likelihood of exploitation is unclear. It is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability remotely by using a TLS client that has restricted but authenticated access, requesting the bucket keys endpoint, and obtaining credentials that bypass normal controls, leading to confidential data exposure or destruction.