CVE-2026-94368: Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header
A flaw was found in noobaa-core within the SigV4 signature verification mechanism. The vulnerability exists in the stringtosignv4 function in src/util/signatureutils.js, where the isSignableHeader predicate is used to filter headers for the canonical string. When a client provides a list of signed headers in the X-Amz-SignedHeaders parameter, NooBaa only includes those specific headers in its signature verification. However, if additional x-amz- headers are present in the request but not listed in X-Amz-SignedHeaders, NooBaa omits them from the signature check instead of rejecting the request. These unsigned headers remain present when the request is passed to the S3 operation handler. An attacker can exploit this by taking a legitimate presigned PUT URL and adding an unsigned x-amz-copy-source header. The S3 handler interprets the presence of this header as a CopyObject request. Because the operation executes with the permissions of the user who generated the presigned URL, the attacker can copy and subsequently read any object that the signer has access to, regardless of the bucket or key restrictions intended by the original URL.
Other sources
A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 (SigV4). Due to improper validation, the service fails to reject requests containing unsigned x-amz- headers, instead simply dropping them from the signature calculation. This allows an attacker who possesses a valid presigned PUT URL to add an unsigned x-amz-copy-source header, effectively converting a simple upload into a CopyObject operation. This can lead to unauthorized access and copying of any data the original signer is permitted to reach across the entire storage system.
— MITRE