{"id":"CVE-2026-115374","title":"github.com/lxc/incus: incus: Information disclosure via unsigned headers in presigned S3 URLs (CVE-2026-115374)","summary":"A flaw was found in Incus. The built-in Simple Storage Service (S3) server does not properly verify request signatures, allowing an attacker with a presigned upload URL to inject unsigned request headers. By supplying an unauthorized copy …","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvssSource":"vendor","cwe":["CWE-347"],"vendor":"Red Hat","product":"incus","affected":["incus >= 7.0.0 < 7.0.2","incus >= 7.1.0 < 7.5.0"],"published":"2026-10-22","updated":"2026-10-23","sourceUpdated":"2026-10-23T18:21:06+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115374.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115374.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-115374"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115374"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115374"},{"url":"https://github.com/lxc/incus/security/advisories/GHSA-mmj7-8rgf-mx2h"},{"url":"https://www.vulncheck.com/advisories/incus-7.0.0-before-7.0.2-and-7.1.0-before-7.5.0-unsigned-header-bypass-in-presigned-s3-upload-urls"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00183,"epssPercentile":0.07851,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-23T14:48:25.416342Z"},"ingestedAt":"2026-10-22T22:00:50.401Z","slug":"CVE-2026-115374","body":"## Overview\n\nA flaw was found in Incus. The built-in Simple Storage Service (S3) server does not properly verify request signatures, allowing an attacker with a presigned upload URL to inject unsigned request headers. By supplying an unauthorized copy source header, an attacker can copy other storage bucket objects to an accessible destination key, leading to unauthorized information disclosure.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115374.json)\n\n**github.com/lxc/incus: incus: Information disclosure via unsigned headers in presigned S3 URLs**. Released 2026-10-22, updated 2026-10-23.\n\nNot affected:\n\n- All currently supported Red Hat products\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}