CVE-2026-71191: Openstack Swift (S3API middleware) vulnerability
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target projectid, container name, and object name are known. This affects all deployments using the default s3acl=false configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Swift (S3API middleware)to a version that resolves this vulnerability.Fixed in 2.38.0 - Configuration
Ensure s3_acl is not left at the default s3_acl=false configuration, since this setting is explicitly stated as affected by the issue (through Swift 2.38.0).
OpenStack Swift S3API middleware s3_acl = false - Compensating control
Assume presigned PUT URLs may be abused to perform server-side copies using the signer’s authorization context; restrict/limit exposure of generated presigned PUT URLs (e.g., revoke/avoid distributing them broadly) until the vulnerability is fixed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71191?
CVE-2026-71191 has a risk rating of 71, indicating it is a significant vulnerability.
How do I fix CVE-2026-71191?
To mitigate CVE-2026-71191, upgrade OpenStack Swift to a version beyond 2.38.0 where this issue has been addressed.
What is CVE-2026-71191?
CVE-2026-71191 is a vulnerability in OpenStack Swift's S3API middleware that allows an attacker to inject unsigned headers into presigned URL requests.
Who is affected by CVE-2026-71191?
All users of OpenStack Swift versions 2.38.0 and earlier are affected by CVE-2026-71191.
What are the potential impacts of CVE-2026-71191?
The potential impact of CVE-2026-71191 includes unauthorized server-side copy operations due to unverified x-amz-* header usage.