CVE-2026-71192: [OSSA-2026-030] OpenStack Swift: S3API header authorization bypass (CVE-2026-71191, CVE-2026-71192)
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose projectid, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3acl=true configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Swift (S3API)to a version that resolves this vulnerability.Fixed in 2.38.0Patch OSSA-2026-030 - Configuration
Disable the non-default configuration s3_acl=true so Swift does not accept/sanitize Swift-native control headers (e.g., X-Copy-From, X-Copy-From-Account) from S3 API requests that can lead to header-based authorization bypass.
OpenStack Swift (S3API middleware) s3_acl = false - Compensating control
As a compensating control, block/deny the ability to submit Swift-native control headers (X-Copy-From, X-Copy-From-Account) in S3 API requests at the network/proxy/WAF layer, until the OSSA-2026-030 fix is applied and s3_acl=true is disabled.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71192?
CVE-2026-71192 has a risk rating of 55, indicating a moderate severity level.
How do I fix CVE-2026-71192?
To mitigate CVE-2026-71192, upgrade OpenStack Swift to version 2.39.0 or later.
What systems are affected by CVE-2026-71192?
CVE-2026-71192 affects OpenStack Swift versions up to and including 2.38.0.
What type of vulnerability is CVE-2026-71192?
CVE-2026-71192 is a vulnerability related to improper sanitization of control headers in S3API requests.
How can an attacker exploit CVE-2026-71192?
An attacker can exploit CVE-2026-71192 by injecting unauthorized control headers into signed PUT requests targeting their own bucket.