CVE-2026-94368

Name of the Vulnerable Software and Affected Versions noobaa-core (affected versions not specified)

Description A flaw exists in the signature verification logic of the noobaa-core component within the NooBaa Multicloud Object Gateway. When processing S3 presigned URLs using Signature Version 4 (SigV4), the service fails to reject requests containing unsigned x-amz- headers, omitting them from the signature calculation instead. An attacker with a valid presigned PUT URL can include an unsigned x-amz-copy-source header to convert a standard upload into a CopyObject operation. This allows unauthorized access and copying of any data accessible to the original signer across the storage system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.