PT-2026-67963 · Openstack · Openstack Swift
CVE-2026-71192
·
Published
2026-08-05
·
Updated
2026-08-05
CVSS v4.0
6.0
Medium
| Vector | AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
OpenStack Swift versions prior to 2.38.1
Description
The S3API middleware fails to sanitize Swift-native control headers
X-Copy-From and X-Copy-From-Account in S3 API requests when the s3 acl=true configuration is enabled. An attacker can inject these headers into a signed PUT request targeting their own bucket, triggering a server-side copy of a private object from another tenant. This occurs because the S3API middleware authorizes the request based on the destination, bypassing authorization for the source object. Consequently, any object can be read if the project id, container name, and object name are known, regardless of ownership or Access Control Lists (ACLs).Recommendations
Update OpenStack Swift to a version newer than 2.38.0.
Disable the
s3 acl=true configuration to prevent the exploitation of this issue.Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openstack Swift