CVE-2026-115374

A flaw was found in Incus. The built-in Simple Storage Service S3 server does not properly verify request signatures, allowing an attacker with a presigned upload URL to inject unsigned request headers. By supplying an unauthorized copy source header, an attacker can copy other storage bucket...