Summary
An improper authorization vulnerability in Incus allows restricted TLS clients to access storage bucket key endpoints in the default project. Exposed S3 access and secret keys could let an attacker read, modify, or delete objects in affected buckets.
An improper authorization vulnerability in Incus allows restricted TLS clients to access storage bucket key endpoints in the default project. Exposed S3 access and secret keys could let an attacker read, modify, or delete objects in affected buckets.
Affected context
The issue occurs in Incus deployments where restricted TLS clients can reach storage bucket key endpoints without authorization being sufficiently limited to the intended project or resources. It primarily affects the default project and becomes risky when the exposed credentials provide access to S3-compatible bucket operations.
The issue occurs in Incus deployments where restricted TLS clients can reach storage bucket key endpoints without authorization being sufficiently limited to the intended project or resources. It primarily affects the default project and becomes risky when the exposed credentials provide access to S3-compatible bucket operations.
Exploit preconditions
- Attack surface: Incus storage bucket key endpoints
- Required access: A restricted TLS client identity with permission to interact with the Incus API
- Trigger point: Requests that retrieve storage bucket access and secret keys
- Why exploitation is possible: Authorization checks do not adequately prevent restricted clients from obtaining credentials associated with buckets in the default project
- Attack surface: Incus storage bucket key endpoints
- Required access: A restricted TLS client identity with permission to interact with the Incus API
- Trigger point: Requests that retrieve storage bucket access and secret keys
- Why exploitation is possible: Authorization checks do not adequately prevent restricted clients from obtaining credentials associated with buckets in the default project
Why this happens
The vulnerability results from an authorization boundary that does not correctly enforce access control for storage bucket key retrieval. A restricted client can reach an endpoint that exposes credentials beyond its intended privilege scope, mapping to CWE-522: Insufficiently Protected Credentials and improper authorization behavior. Once disclosed, the credentials may be used against the associated S3-compatible storage service.
The vulnerability results from an authorization boundary that does not correctly enforce access control for storage bucket key retrieval. A restricted client can reach an endpoint that exposes credentials beyond its intended privilege scope, mapping to CWE-522: Insufficiently Protected Credentials and improper authorization behavior. Once disclosed, the credentials may be used against the associated S3-compatible storage service.
Potential impact
- Attackers may obtain S3 access and secret keys
- Unauthorized parties could read objects stored in affected buckets
- Attackers could modify or delete bucket contents
- Data confidentiality, integrity, and availability may be compromised
- Exposed credentials could enable follow-on access to connected storage workflows
- Attackers may obtain S3 access and secret keys
- Unauthorized parties could read objects stored in affected buckets
- Attackers could modify or delete bucket contents
- Data confidentiality, integrity, and availability may be compromised
- Exposed credentials could enable follow-on access to connected storage workflows
General mitigation guidance
Mitigation generally focuses on enforcing authorization at every storage bucket credential endpoint and reducing the trust placed in restricted client identities.
Common defensive patterns include:
- Apply explicit project-, bucket-, and operation-level authorization checks
- Ensure restricted clients cannot retrieve credentials outside their authorized scope
- Prefer short-lived, narrowly scoped storage credentials where supported
- Reduce credential privileges to only the required object operations
- Protect credential responses from logging, caching, and unnecessary disclosure
- Rotate potentially exposed keys and review bucket permissions as part of incident response
- Monitor and restrict access to the default project
Mitigation generally focuses on enforcing authorization at every storage bucket credential endpoint and reducing the trust placed in restricted client identities.
Common defensive patterns include:
- Apply explicit project-, bucket-, and operation-level authorization checks
- Ensure restricted clients cannot retrieve credentials outside their authorized scope
- Prefer short-lived, narrowly scoped storage credentials where supported
- Reduce credential privileges to only the required object operations
- Protect credential responses from logging, caching, and unnecessary disclosure
- Rotate potentially exposed keys and review bucket permissions as part of incident response
- Monitor and restrict access to the default project
How teams detect issues like this
Organizations can detect this class of issue through:
- Authorization tests covering restricted TLS identities and default-project resources
- Static and architectural review of API handlers that return storage credentials
- Code review signals showing project or bucket lookups performed without an equivalent authorization check
- Policy tests confirming that credential endpoints enforce least privilege
- Audit monitoring for unusual bucket-key retrievals and subsequent object operations
- Automated API security testing that evaluates access-control behavior across client roles
Organizations can detect this class of issue through:
- Authorization tests covering restricted TLS identities and default-project resources
- Static and architectural review of API handlers that return storage credentials
- Code review signals showing project or bucket lookups performed without an equivalent authorization check
- Policy tests confirming that credential endpoints enforce least privilege
- Audit monitoring for unusual bucket-key retrievals and subsequent object operations
- Automated API security testing that evaluates access-control behavior across client roles
