CVE-2026-115374
Description
A flaw was found in Incus. The built-in Simple Storage Service (S3) server does not properly verify request signatures, allowing an attacker with a presigned upload URL to inject unsigned request headers. By supplying an unauthorized copy source header, an attacker can copy other storage bucket objects to an accessible destination key, leading to unauthorized information disclosure.
Statement
This vulnerability is rated as Important because remote users possessing valid presigned upload links can bypass signature verification to inspect and duplicate unauthorized bucket objects, causing high confidentiality impact. Incus is not included or supported in Red Hat Enterprise Linux, limiting exposure strictly to Fedora community package deployments. Furthermore, exploiting this flaw requires the daemon's internal S3-compatible endpoint to be actively configured and utilized for generating presigned upload requests.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
