CVE-2026-115374 Details
Description
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags.
A vulnerability exists in Incus versions 7.0.0 prior to 7.0.2 and 7.1.0 prior to 7.5.0, where the built-in S3 server improperly verifies signatures on presigned URLs. This flaw allows holders of presigned upload URLs to inject unsigned x-amz-* headers. Specifically, an unsigned X-Amz-Copy-Source header can be added to a presigned upload URL, enabling the copying of objects from other buckets onto the designated key. This action discloses the contents and ETags of the copied objects.
Users are advised not to distribute presigned URLs for buckets containing sensitive objects, or to keep the bucket listener disabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Incus | >= 7.0.0, < 7.0.2 (semver) >= 7.1.0, < 7.5.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |