CVE-2026-71191 Details
Description
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.
A vulnerability in OpenStack Swift's S3API middleware prior to version 2.38.0 allows for unauthorized object copying and reading between tenants. This issue arises because the middleware does not properly validate certain request headers, enabling an attacker to exploit presigned URLs. In deployments with the default 's3_acl=false' setting, an unsigned 'X-Amz-Copy-Source' header can be injected, leveraging the signer's authorization to copy objects from arbitrary sources. Conversely, in environments where 's3_acl=true' is enabled, user-specific headers can be used to access private objects of other users without their permission. The vulnerability affects all versions of Swift from 2.18.0 up to 2.38.0, excluding the patched releases.
Users can update to OpenStack Swift versions 2.35.4, 2.36.3, 2.37.3, or 2.38.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |