CVE-2026-71192
published 2026-08-05CVE-2026-71192: In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests…
PriorityP339medium6CVSS 4.0
AVNACLATPPRLUINVCHVINVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.44%
37.1th percentile
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An
attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3_acl=true configuration.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | swift | — | — |
| openstack | swift | >= 2.18.0 < 2.35.4 | 2.35.4 |
| openstack | swift | >= 2.36.0 < 2.36.3 | 2.36.3 |
| openstack | swift | >= 2.37.0 < 2.37.3 | 2.37.3 |
| rhoso | openstack-swift-account-rhel9 | — | — |
| rhoso | openstack-swift-base-rhel9 | — | — |
| rhoso | openstack-swift-container-rhel9 | — | — |
| rhoso | openstack-swift-object-rhel9 | — | — |
| rhoso | openstack-swift-proxy-server-rhel9 | — | — |
| rhosp-rhel8 | openstack-swift-account | — | — |
| rhosp-rhel8 | openstack-swift-base | — | — |
| rhosp-rhel8 | openstack-swift-container | — | — |
| rhosp-rhel8 | openstack-swift-object | — | — |
| rhosp-rhel8 | openstack-swift-proxy-server | — | — |
| rhosp-rhel9 | openstack-swift-account | — | — |
| rhosp-rhel9 | openstack-swift-base | — | — |
| rhosp-rhel9 | openstack-swift-container | — | — |
| rhosp-rhel9 | openstack-swift-object | — | — |
| rhosp-rhel9 | openstack-swift-proxy-server | — | — |
| rhosp13 | openstack-swift-account | — | — |
| rhosp13 | openstack-swift-base | — | — |
| rhosp13 | openstack-swift-container | — | — |
| rhosp13 | openstack-swift-object | — | — |
| rhosp13 | openstack-swift-proxy-server | — | — |
CVSS provenance
nvdv4.06.0MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
OpenStack Swift up to 2.35.3/2.36.2/2.37.2/2.38.0 S3API Middleware improper authorization
vuldb·2026-09-11·CVSS 6.0
CVE-2026-71192 [MEDIUM] OpenStack Swift up to 2.35.3/2.36.2/2.37.2/2.38.0 S3API Middleware improper authorization
A vulnerability has been found in OpenStack Swift up to 2.35.3/2.36.2/2.37.2/2.38.0 and classified as problematic. This affects an unknown part of the component S3API Middleware. Performing a manipulation results in improper authorization.
This vulnerability is known as CVE-2026-71192. Remote exploitation of the attack is possible. No exploit is available.
The affected component should be upgraded.
GHSA
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true.
ghsa_unreviewed·2026-08-05
CVE-2026-71192 [MEDIUM] CWE-863 In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true.
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An
attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3_acl=true configuration.
Red Hat
openstack-swift: openstack-swift: S3API cross-tenant object read via Swift-native header injection
vendor_redhat·2026-07-28·CVSS 6.0
CVE-2026-71192 [MEDIUM] CWE-863 openstack-swift: openstack-swift: S3API cross-tenant object read via Swift-native header injection
openstack-swift: openstack-swift: S3API cross-tenant object read via Swift-native header injection
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An
attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3_acl=true configuration.
A flaw was f
No detection rules found.
No public exploits indexed.
2026-08-05
Published