CVE-2026-115374: Improper Verification of Cryptographic Signature in lxc incus

CVE-2026-115374 describes a vulnerability in the Incus built-in S3 server's signature verification mechanism. Specifically, presigned URL holders can inject unsigned x-amz-* headers due to improper verification of cryptographic signatures. This enables an attacker to add an unsigned X-Amz-Copy-Source header to a presigned upload URL, allowing them to copy objects from other buckets onto the target key. This results in unauthorized disclosure of the contents and ETags of those objects. The vulnerability affects Incus versions >=7.0.0 <7.0.2 and >=7.1.0 <7.5.0.

An attacker with access to a presigned upload URL can exploit this flaw to copy objects from other buckets onto the granted key, leading to unauthorized disclosure of object contents and ETags. This compromises confidentiality of data stored in the affected Incus S3 server.

A patch is available for this vulnerability. Users should upgrade Incus to version 7.0.2 or later, or 7.5.0 or later, to remediate this issue. Since this is a cloud service, the vendor manages remediation for the hosted service; users should verify with the vendor that their environment is updated accordingly.