CVE-2026-97149: Medium severity Openstack Swift vulnerability
In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are those running OpenStack Swift before 2.38.2 that use the shipped default proxy pipeline containing both the tempurl and copy middleware, with account-level TempURL keys enabled.
What does an attacker need to exploit this?
The attacker needs a PUT TempURL for a destination object and a GET TempURL for that destination. They can add X-Copy-From to the signed PUT request to copy another object from the same account into the destination.
Are objects in other accounts exposed through this issue?
No. The copy middleware rejects copy requests across account boundaries, so the described exposure is limited to objects in the same account.
How can I determine whether my deployment is already at risk?
Check whether Swift is earlier than 2.38.2, whether the proxy pipeline uses the shipped default configuration with tempurl and copy middleware, and whether TempURL keys are configured at the account level.