Live › vulnerability › CVE-2026-115374
Go to dashboardIncus's built-in S3 server does not verify some x-amz-* headers in presigned URLs, so a holder of a presigned upload URL can add an unsigned X-Amz-Copy-Source header. This copies other objects in the bucket onto the granted key, exposing their contents and ETags.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only deployments running Incus 7.0.0 to before 7.0.2 or 7.1.0 to before 7.5.0 that expose the built-in S3 server and issue presigned URLs are exposed. Anyone who holds a presigned upload URL can read other objects in the same bucket. Systems not running the built-in S3 server can skip it.
No product ranges from the sources yet.
incus version and compare against the affected ranges: 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0.7.0.2 on the 7.0 branch or to 7.5.0 on the 7.1 branch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags.
This page as .md · .json · in your agent: get_signal("CVE-2026-115374")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.