CVE-2026-71191
published 2026-08-05CVE-2026-71191: In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL…
PriorityP344medium6CVSS 4.0
AVNACLATPPRLUINVCHVINVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.56%
46.1th percentile
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | swift | — | — |
| openstack | swift | >= 2.18.0 < 2.35.4 | 2.35.4 |
| openstack | swift | >= 2.36.0 < 2.36.3 | 2.36.3 |
| openstack | swift | >= 2.37.0 < 2.37.3 | 2.37.3 |
| rhoso | openstack-swift-account-rhel9 | — | — |
| rhoso | openstack-swift-base-rhel9 | — | — |
| rhoso | openstack-swift-container-rhel9 | — | — |
| rhoso | openstack-swift-object-rhel9 | — | — |
| rhoso | openstack-swift-proxy-server-rhel9 | — | — |
| rhosp-rhel8 | openstack-swift-account | — | — |
| rhosp-rhel8 | openstack-swift-base | — | — |
| rhosp-rhel8 | openstack-swift-container | — | — |
| rhosp-rhel8 | openstack-swift-object | — | — |
| rhosp-rhel8 | openstack-swift-proxy-server | — | — |
| rhosp-rhel9 | openstack-swift-account | — | — |
| rhosp-rhel9 | openstack-swift-base | — | — |
| rhosp-rhel9 | openstack-swift-container | — | — |
| rhosp-rhel9 | openstack-swift-object | — | — |
| rhosp-rhel9 | openstack-swift-proxy-server | — | — |
| rhosp13 | openstack-swift-account | — | — |
| rhosp13 | openstack-swift-base | — | — |
| rhosp13 | openstack-swift-container | — | — |
| rhosp13 | openstack-swift-object | — | — |
| rhosp13 | openstack-swift-proxy-server | — | — |
CVSS provenance
nvdv4.06.0MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
OpenStack Swift up to 2.35.3/2.36.2/2.37.2/2.38.0 S3API Middleware X-Amz-Copy-Source improper authorization (CNNVD-2026-82257151)
vuldb·2026-09-11·CVSS 6.0
CVE-2026-71191 [MEDIUM] OpenStack Swift up to 2.35.3/2.36.2/2.37.2/2.38.0 S3API Middleware X-Amz-Copy-Source improper authorization (CNNVD-2026-82257151)
A vulnerability, which was classified as critical, was found in OpenStack Swift up to 2.35.3/2.36.2/2.37.2/2.38.0. Affected by this issue is some unknown functionality of the component S3API Middleware. Such manipulation of the argument X-Amz-Copy-Source leads to improper authorization.
This vulnerability is traded as CVE-2026-71191. The attack may be launched remotely. There is no exploit available.
You should upgrade the affected component.
GHSA
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests.
ghsa_unreviewed·2026-08-05
CVE-2026-71191 [MEDIUM] CWE-863 In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests.
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.
Red Hat
openstack-swift: openstack-swift: S3API presigned URL unsigned header authorization bypass
vendor_redhat·2026-07-28·CVSS 6.0
CVE-2026-71191 [MEDIUM] CWE-863 openstack-swift: openstack-swift: S3API presigned URL unsigned header authorization bypass
openstack-swift: openstack-swift: S3API presigned URL unsigned header authorization bypass
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.
A flaw was found in the S3API middleware of OpenStack Swift. The SigV4 presigned URL implementation does not require that sema
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-05
Published