CVE-2026-115374: Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs

Q: Who is exposed to this issue?

Deployments running Incus 7.0.0 or 7.0.1, or Incus 7.1.0 through 7.4.0, are affected if they use the built-in S3 server and issue presigned upload URLs.

Q: What does an attacker need to exploit the flaw?

An attacker needs a presigned S3 upload URL. They can then add an unsigned X-Amz-Copy-Source header to copy another bucket object to the key authorized by that URL.

Q: What data can be exposed through exploitation?

The flaw can disclose the contents and ETags of other objects in the bucket by copying those objects onto the key granted by the presigned URL.

Q: Which versions address the issue?

The affected version ranges end before Incus 7.0.2 and before Incus 7.5.0. Upgrading to the applicable fixed release resolves the vulnerable version condition.

Published Oct 22, 2026

Updated

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz- headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags.

Affected Software

1 affected component

Linux Containers Incus>=7.0.0<7.0.2, >=7.1.0<7.5.0

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments running Incus 7.0.0 or 7.0.1, or Incus 7.1.0 through 7.4.0, are affected if they use the built-in S3 server and issue presigned upload URLs.

What does an attacker need to exploit the flaw?

An attacker needs a presigned S3 upload URL. They can then add an unsigned X-Amz-Copy-Source header to copy another bucket object to the key authorized by that URL.

What data can be exposed through exploitation?

The flaw can disclose the contents and ETags of other objects in the bucket by copying those objects onto the key granted by the presigned URL.

Which versions address the issue?

The affected version ranges end before Incus 7.0.2 and before Incus 7.5.0. Upgrading to the applicable fixed release resolves the vulnerable version condition.

CVE-2026-115374: Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the flaw?

What data can be exposed through exploitation?

Which versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the flaw?

What data can be exposed through exploitation?

Which versions address the issue?