CVE-2026-50221

Name of the Vulnerable Software and Affected Versions OpenStack Swift versions prior to 2.37.2

Description The proxy-server fails to strip internal update headers from client requests before forwarding them to object-servers. An authenticated user with write access can inject the headers X-Container-Host, X-Container-Device, X-Delete-At-Host, and X-Delete-At-Device to redirect container update requests to an attacker-controlled server, resulting in server-side request forgery (SSRF). This allows the exposure of internal cluster metadata, such as storage policy indexes, partition mappings, device names, and, when at-rest encryption is active, cipher text and initialization vectors for the container-level encryption key. Additionally, the shard-range redirect mechanism can be used to create ghost listings in arbitrary containers.

Recommendations Update to version 2.37.2 or later.