CVE-2026-94368
Received Received - Intake

NooBaa Multicloud Object Gateway Signature Verification Bypass

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: redhat-SADP

Description
A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 (SigV4). Due to improper validation, the service fails to reject requests containing unsigned x-amz- headers, instead simply dropping them from the signature calculation. This allows an attacker who possesses a valid presigned PUT URL to add an unsigned x-amz-copy-source header, effectively converting a simple upload into a CopyObject operation. This can lead to unauthorized access and copying of any data the original signer is permitted to reach across the entire storage system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94368
EUVD
EUVD-2026-83898

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
noobaa noobaa-core *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in noobaa-core, the core component of the NooBaa Multicloud Object Gateway. It involves improper signature verification when processing S3 presigned URLs using Signature Version 4 (SigV4). The service fails to reject requests with unsigned x-amz- headers, dropping them from signature calculation instead. An attacker with a valid presigned PUT URL can add an unsigned x-amz-copy-source header, converting the request into a CopyObject operation. This allows unauthorized access and copying of data the original signer can access.

Detection Guidance

Monitor NooBaa logs for unusual S3 operations, particularly CopyObject requests originating from PUT presigned URLs. Check for requests containing unsigned x-amz-copy-source headers alongside valid presigned URLs. Use network traffic analysis tools to inspect S3 API calls for header manipulation patterns.

Impact Analysis

An attacker could exploit this to bypass access controls and read or overwrite any data accessible to the user who generated the presigned URL. This includes copying sensitive files, modifying data, or exfiltrating information across the entire storage system. The attack requires only a valid presigned URL, making it easier to execute.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using NooBaa Multicloud Object Gateway may face compliance violations, legal penalties, and reputational damage due to potential data breaches or unauthorized data exposure.

Mitigation Strategies

Disable presigned URLs for NooBaa S3 operations until a patch is available. Implement strict header validation at the proxy or load balancer level to reject requests with unsigned x-amz- headers. Temporarily restrict access to sensitive data buckets until mitigation is confirmed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94368. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart