Incus CVE-2026-115374

Exploitation requires: (1) the affected Incus version running a storage bucket on a local storage pool using the built-in in-process S3 server (Ceph radosgw buckets are NOT affected); (2) the bucket listener core.storage_buckets_address to be enabled, which is DISABLED by default; and (3) the attacker to possess a valid presigned upload (PUT) URL for an object in the target bucket - no separate bucket credentials are needed, but the presigned grant is the entry point. The attacker then attaches an unsigned X-Amz-Copy-Source header, which the canonical-request signature check never validates because it only iterates the client-supplied X-Amz-SignedHeaders list (and the SigV2 presigned path omits CanonicalizedAmzHeaders entirely). Full disclosure of a target object's contents additionally requires the attacker to be able to read the granted key (e.g. via a matching presigned download URL); the ETag of the source object leaks regardless. Limiting factors: non-default listener, local-pool-only built-in S3 server, and the need for a pre-existing presigned-URL grant.

CVSS 4.0 base score is 7.1 (High), driven by a network vector (AV:N), low complexity (AC:L), no attack requirements (AT:N), and high confidentiality impact (VC:H) with only low integrity impact (VI:L) and no availability impact. Crucially, the vector requires privileges (PR:L): the attacker must already hold a valid presigned S3 URL, which is itself a vendor-issued grant rather than fully anonymous access, so this is not an unauthenticated internet-wide flaw. No EPSS score, CISA KEV listing, or SSVC automatable/technical-impact fields were supplied; the only prioritization signal is the vuln.today decision label 'this_week' (not act_now/emergency), which is consistent with a real but non-emergency issue. No public exploit was identified at time of analysis. The practical risk is meaningfully reduced by configuration: the built-in S3 bucket listener (core.storage_buckets_address) is disabled by default and Ceph radosgw buckets are unaffected, so only operators who deliberately enabled the local-pool S3 server and handed out presigned URLs for buckets containing sensitive objects are exposed. Net assessment: a genuine confidentiality risk worth patching on a normal cycle, but bounded by non-default deployment and the need for a pre-existing presigned-URL grant rather than a widespread, high-urgency threat.

An operator issues a presigned upload (PUT) URL for a single object in an Incus local-pool S3 bucket to a semi-trusted party. That party adds an unsigned X-Amz-Copy-Source header to the request, causing the server to copy another object in the same bucket onto the granted key under the signer's credentials; if the holder can also read that key (e.g. via a matching presigned download URL), the contents and ETag of the arbitrary source object are disclosed. No public exploit was identified at time of analysis.