CVE-2026-71192
Severity CVSS v4.0:
MEDIUM
Type:
Unavailable / Other
Publication date:
05/08/2026
Last modified:
05/08/2026
Description
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An<br />
attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant&#39;s private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object&#39;s ACLs or ownership. This requires the non-default s3_acl=true configuration.
Impact
Base Score 4.0
6.00
Severity 4.0
MEDIUM