CVE-2026-71192
Gravedad CVSS v4.0:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
05/08/2026
Última modificación:
05/08/2026
Descripción
*** Pendiente de traducción *** In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An<br />
attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant&#39;s private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object&#39;s ACLs or ownership. This requires the non-default s3_acl=true configuration.
Impacto
Puntuación base 4.0
6.00
Gravedad 4.0
MEDIA