CVE-2026-115374

High

Description

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags.

SeverityHigh

CVSS7.1

Exploit probability—

ProductLxc Incus

PublishedOct 22, 2026

First seenOct 22, 2026

Weakness typeCWE-347CWE-347

How to fix

Update

lxc incus7.0.2, 7.5.0 or later

Vendor advisories

github.com/lxc/incus/security/advisories/GHSA-mmj7-8rgf-mx2h

Affected products

Product	Affected versions	Fixed in
lxc incus	7.0.0 ≤ v < 7.0.2, 7.1.0 ≤ v < 7.5.0	7.0.2, 7.5.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.