---
id: CVE-2026-115374
title: >-
  github.com/lxc/incus: incus: Information disclosure via unsigned headers in
  presigned S3 URLs (CVE-2026-115374)
summary: >-
  A flaw was found in Incus. The built-in Simple Storage Service (S3) server
  does not properly verify request signatures, allowing an attacker with a
  presigned upload URL to inject unsigned request headers. By supplying an
  unauthorized copy …
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cvssSource: vendor
cwe:
  - CWE-347
vendor: Red Hat
product: incus
affected:
  - incus >= 7.0.0 < 7.0.2
  - incus >= 7.1.0 < 7.5.0
published: '2026-10-22'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T18:21:06+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115374.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115374.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-115374'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-115374'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-115374'
  - url: 'https://github.com/lxc/incus/security/advisories/GHSA-mmj7-8rgf-mx2h'
  - url: >-
      https://www.vulncheck.com/advisories/incus-7.0.0-before-7.0.2-and-7.1.0-before-7.5.0-unsigned-header-bypass-in-presigned-s3-upload-urls
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00183
epssPercentile: 0.07851
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-23T14:48:25.416342Z'
ingestedAt: '2026-10-22T22:00:50.401Z'
---

## Overview

A flaw was found in Incus. The built-in Simple Storage Service (S3) server does not properly verify request signatures, allowing an attacker with a presigned upload URL to inject unsigned request headers. By supplying an unauthorized copy source header, an attacker can copy other storage bucket objects to an accessible destination key, leading to unauthorized information disclosure.

## Vendor advisories

- **Red Hat VEX** · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115374.json)

**github.com/lxc/incus: incus: Information disclosure via unsigned headers in presigned S3 URLs**. Released 2026-10-22, updated 2026-10-23.

Not affected:

- All currently supported Red Hat products

## Remediation

Refer to the advisory for fix availability.