CVE-2026-115374 lxc CVE debrief

Who should care

Defenders responsible for Incus deployments, especially those using presigned S3 upload URLs, should assess their configurations and take steps to mitigate this vulnerability. This includes verifying Incus deployments for exposure, assessing configurations for unsigned header injection, and prioritizing updates to a fixed version. Security teams and vulnerability management teams should also review the configurations and ensure that compensating controls,

Why it matters

Defenders should prioritize verifying Incus deployments for exposure, especially those using presigned S3 upload URLs, and take steps to mitigate this vulnerability to prevent potential disclosure of object contents and ETags.

• Potential disclosure of object contents and ETags
• Possible unauthorized access to sensitive data
• Need for verification of Incus deployments and configurations
• Priority for updating to a fixed version

Technical summary

The vulnerability allows presigned URL holders to inject unsigned x-amz-* headers, potentially disclosing object contents and ETags. This issue affects Incus versions 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0. Defenders should assess their configurations, especially those using presigned S3 upload URLs, to mitigate this vulnerability and prevent potential disclosure of object contents and ETags. The flaw in the built-in S3 server's signature verification process enables attackers to add an unsigned X-Amz-Copy-Source header to a presigned upload URL, allowing them to copy other bucket objects onto the granted key.

Defensive priority

Defenders should prioritize verifying Incus deployments for exposure, especially those using presigned S3 upload URLs. They should assess if their configurations allow unsigned header injection and take steps to mitigate this vulnerability.

Recommended defensive actions

• Verify Incus deployments for exposure, especially those using presigned S3 upload URLs
• Assess configurations for unsigned header injection
• Mitigate the vulnerability by updating to a fixed version
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and a description of the issue. However, there is limited information on exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.