CVE-2026-71192
Received Received - Intake

Swift S3API Header Injection Leading to Unauthorized Object Access

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: MITRE

Description
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3_acl=true configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71192
EUVD
EUVD-2026-53050

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openstack swift From 2.18.0 (inc) to 2.35.4 (exc)
openstack swift From 2.35.4 (inc) to 2.38.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OpenStack Swift through 2.38.0 allows an attacker to bypass authorization checks by injecting Swift-native control headers like X-Copy-From into a signed PUT request. If the non-default s3_acl=true setting is enabled, the attacker can copy or read private objects from another tenant's bucket by targeting known container and object names, even if the source object has strict access controls.

Detection Guidance

Detecting this vulnerability requires checking OpenStack Swift versions and S3API middleware configurations. Verify Swift versions between 2.18.0 and 2.38.0 with s3_acl=true enabled. Inspect logs for unusual PUT requests with X-Copy-From or X-Copy-From-Account headers targeting other tenants' objects.

Impact Analysis

If you use OpenStack Swift with the S3API middleware and s3_acl=true, an attacker could access your private objects if they know your container and object names. This could lead to unauthorized data exposure, data theft, or privacy violations for affected deployments.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR (privacy) and HIPAA (health data). Organizations using affected Swift versions may face legal penalties, reputational damage, and loss of trust due to data breaches.

Mitigation Strategies

Upgrade OpenStack Swift to versions 2.35.4, 2.36.3, 2.37.3, or 2.38.0 or later. Disable s3_acl if not required. Apply patches for OpenStack releases 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, or 2026.2/hibiscus. Monitor for unauthorized access attempts and review S3API middleware configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart