CVE-2026-115374

Name of the Vulnerable Software and Affected Versions Incus versions 7.0.0 through 7.0.1 Incus versions 7.1.0 through 7.4.9

Description A signature verification flaw exists in the built-in S3 server. This issue allows holders of presigned URLs to inject unsigned x-amz-* headers. Specifically, an attacker can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, which leads to the disclosure of their contents and ETags (Entity Tags, which are unique identifiers for a specific version of a resource).

Recommendations Update Incus versions 7.0.0 through 7.0.1 to version 7.0.2. Update Incus versions 7.1.0 through 7.4.9 to version 7.5.0.