CVE-2026-115374 in Incus
Summary
by MITRE • 10/22/2026
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Incus versions 7.0.0 through 7.0.2 and 7.1.0 through 7.5.0 represents a critical flaw within the built-in S3-compatible server component responsible for handling presigned URLs. Presigned URLs are a standard mechanism provided by object storage systems like Amazon S3, allowing users to grant temporary access to specific objects without requiring long-term credentials. The core issue stems from an insufficient signature verification process where the system fails to properly validate or restrict certain HTTP headers associated with the request when using these presigned links. Specifically, the flaw allows attackers who possess a valid presigned URL for upload operations to inject unsigned x-amz-* metadata headers into their requests. This deviation from expected behavior undermines the integrity of the signature verification mechanism, which is designed to ensure that only authorized actions and data modifications are permitted under the scope of the generated token.
From a technical perspective, this vulnerability enables an unauthorized actor to manipulate server-side operations by exploiting the X-Amz-Copy-Source header. In standard S3 API behavior, presigned URLs for uploads typically restrict the client to writing or overwriting content at a specific key path. However, due to the signature verification flaw, an attacker can append an unsigned X-Amz-Copy-Source header that instructs the server to copy data from another object within the same bucket onto the target location defined by the presigned URL. This effectively bypasses access controls because the server processes the copy operation as part of the authenticated upload request, even though the source object being copied was not explicitly authorized for access via the original presigned URL. The system incorrectly treats the injected header as valid metadata rather than rejecting it or requiring a separate signature for cross-object operations.
The operational impact of this vulnerability is severe, primarily centering on unauthorized data disclosure and integrity compromise. By leveraging the X-Amz-Copy-Source injection, an attacker can read arbitrary objects from the bucket by copying their contents to a location they control or where they have write access via the presigned URL. This results in a complete bypass of object-level permissions, allowing sensitive information stored within the S3-compatible storage to be exfiltrated without direct authentication for those specific files. Furthermore, because the operation involves copying objects, it also exposes metadata such as ETags (Entity Tags), which can provide additional insights into file versions and integrity states. This capability transforms a simple upload vulnerability into a comprehensive data breach vector, potentially exposing confidential business records, user data, or proprietary assets depending on what is stored in the affected Incus instance.
This flaw aligns with CWE-284 Improper Access Control, as it involves failing to enforce proper restrictions on authenticated users regarding specific resources. Additionally, it relates to CWE-798 Use of Hard-coded Credentials if one considers that presigned URLs act as temporary credentials, and the failure to verify associated headers allows unauthorized access akin to credential misuse. In terms of MITRE ATT&CK mapping, this vulnerability facilitates Data Exfiltration from Remote Systems (T1530) by allowing an attacker to retrieve data they do not have explicit permission to view. It also touches upon Abuse of Cloud Services (T1578), specifically the exploitation of misconfigured storage buckets or APIs that fail to properly validate request parameters and headers against their intended scope.
To mitigate this risk, organizations running Incus must immediately upgrade to version 7.0.2 for the 7.0.x branch or version 7.5.0 and later for the 7.1.x branch. These updates contain patches that enforce strict validation of x-amz-* headers in presigned URL requests, ensuring that only headers explicitly permitted by the signature are processed. Until an upgrade is performed, administrators should implement network-level controls such as Web Application Firewalls (WAF) to inspect and block HTTP requests containing suspicious X-Amz-Copy-Source headers directed at Incus S3 endpoints. Additionally, reviewing access policies for presigned URLs to ensure they have minimal necessary permissions can reduce the blast radius if an exploitation attempt occurs. Regular auditing of storage bucket configurations and monitoring for unusual copy operations or high-volume data retrieval patterns are recommended defensive measures to detect potential abuse of this vulnerability in real-time.