CVE-2026-71191
Received Received - Intake

Swift S3API Presigned URL Header Injection Vulnerability

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: MITRE

Description
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71191
EUVD
EUVD-2026-53049

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openstack swift to 2.38.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenStack Swift versions up to 2.38.0. It involves the S3API middleware not properly validating that certain headers like X-Amz-Copy-Source are included in the SigV4 signature for presigned URL requests. An attacker with a valid presigned PUT URL can add an unsigned X-Amz-Copy-Source header to perform a server-side copy from any object the signer has access to, provided they know the project ID, container name, and object name.

Impact Analysis

If you use OpenStack Swift with the default s3_acl=false setting, an attacker could exploit this to read sensitive data from objects you have access to. They would need a valid presigned URL and knowledge of your project, container, and object names. This could lead to unauthorized data exposure or information theft.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized data exposure may result in legal penalties, reputational damage, and loss of trust. Organizations must ensure proper access controls and patch systems to mitigate risks.

Mitigation Strategies

Upgrade OpenStack Swift to a version beyond 2.38.0 to address the S3API middleware issue with SigV4 signature enforcement on presigned URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71191. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart