Signature Verification Flaw in Incus S3 Server by Canonical

CVE-2026-115374

What is CVE-2026-115374?

Incus versions 7.0.0 prior to 7.0.2 and 7.1.0 prior to 7.5.0 contain a vulnerability in the built-in S3 server that permits presigned URL holders to inject unsigned x-amz-* headers. By exploiting this flaw, attackers can utilize an unsigned X-Amz-Copy-Source header within a presigned upload URL to copy objects from other buckets to the designated key, potentially exposing sensitive data and ETags. This could lead to unauthorized access to restrictively shared resources.

References