CVE catalog
CVE-2026-115374
UBUNTU-CVE-2026-115374
- Severity
- Unknown · CVSS 7.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.18% · Oct 25, 2026
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | incus | 14 | 6.0.4-2 | vulnerable |
| Debian | incus | 14 | 6.0.4-3 | vulnerable |
| Debian | incus | 14 | 6.0.5-1 | vulnerable |
| Debian | incus | 14 | 6.0.5-2 | vulnerable |
| Debian | incus | 14 | 6.0.5-3 | vulnerable |
| Debian | incus | 14 | 6.0.5-4 | vulnerable |
| Debian | incus | 14 | 6.0.5-5 | vulnerable |
| Debian | incus | 14 | 6.0.5-6 | vulnerable |
| Debian | incus | 14 | 6.0.5-7 | vulnerable |
| Debian | incus | 14 | 6.0.5-8 | vulnerable |
| Debian | incus | 14 | 6.0.6-1 | vulnerable |
| Debian | incus | 14 | 6.0.6-2 | vulnerable |
| Debian | incus | 14 | 6.0.6-3 | vulnerable |
| Debian | incus | 14 | 6.14.0-1~exp1 | vulnerable |
| Debian | incus | 14 | 6.15.0-1~exp1 | vulnerable |
| Debian | incus | 14 | 6.16.0-1~exp1 | vulnerable |
| Debian | incus | 14 | 6.17.0-1~exp1 | vulnerable |
| Debian | incus | 14 | 6.20.0-1~exp1 | vulnerable |
| Debian | incus | 14 | 6.21.0-1~exp1 | vulnerable |
| Debian | incus | 14 | 6.22.0-1~exp1 | vulnerable |
| Debian | incus | 14 | 6.23.0-1~exp1 | vulnerable |
| Debian | incus | 14 | 7.0.0-1 | vulnerable |
| Debian | incus | 14 | 7.0.0-1~bpo13+1 | vulnerable |
| Debian | incus | 14 | 7.0.0-2 | vulnerable |
| Debian | incus | 14 | 7.0.0-2~bpo13+1 | vulnerable |
| Debian | incus | 14 | 7.0.0-3 | vulnerable |
| Debian | incus | 14 | 7.0.0-4 | vulnerable |
| Debian | incus | 14 | 7.0.0-5 | vulnerable |
| Debian | incus | 14 | 7.0.0-5~bpo13+1 | vulnerable |
| Debian | incus | 14 | 7.0.1-1 | vulnerable |
| Debian | incus | 14 | 7.0.1-1~bpo13+1 | vulnerable |
| Debian | incus | 14 | 7.0.1-2 | vulnerable |
| Debian | incus | 14 | 7.0.1-2~bpo13+1 | vulnerable |
| Debian | incus | 14 | 7.0.1-3 | vulnerable |
| Debian | incus | 14 | 7.0.1-3~bpo13+1 | vulnerable |
| Debian | incus | 14 | 7.0.1-4 | vulnerable |
| Debian | incus | 14 | 7.0.1-5~bpo13+1 | vulnerable |
| Debian | incus | 14 | 7.0.1-5 | fixed |
| Ubuntu | incus | pro | 6.0.4-2 | vulnerable |
| Ubuntu | incus | pro | 6.0.5-8 | vulnerable |
| Ubuntu | incus | pro | 6.0.5-8ubuntu0.26.04.1~esm1 | vulnerable |
| Ubuntu | incus | 26.10 | 6.0.5-8 | vulnerable |
| Ubuntu | incus | 26.10 | 7.0.1-5 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | incus | deb | 14 | 7.0.1-5 | Not reported | DEBIAN-CVE-2026-115374 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: