CVE-2026-97149

Name of the Vulnerable Software and Affected Versions OpenStack Swift versions prior to 2.38.2

Description The tempurl middleware fails to reject the X-Copy-From header during PUT requests. Because a TempURL signature only validates the method, expiry, and path, the system relies on a list of disallowed headers to prevent unauthorized modifications to the request. An attacker with a PUT TempURL for a specific object can include the X-Copy-From header to specify any other object within the same account. The copy middleware then copies the target object to the destination, allowing the attacker to retrieve the victim's data using a GET TempURL for that destination object. This issue only affects deployments using the default proxy pipeline containing both tempurl and copy middleware with account-level TempURL keys. Copies across different account boundaries are not possible.

Recommendations Update OpenStack Swift to version 2.38.2 or later.