https://seclists.org/oss-sec/2026/q3/920: [OSSA-2026-041] OpenStack Swift: Cross-container information disclosuvia Swift tempurl (CVE-2026-97149)
Published Sep 24, 2026
·Updated
Affected Software
1 affected component
Openstack Swift
Frequently Asked Questions
1
Which Swift deployments are exposed?
Only deployments with the tempurl middleware enabled are affected. The issue applies when a party holds a single-object PUT TempURL signed using an account-level TempURL key.
2
What does an attacker need to disclose another object's contents?
The attacker needs a qualifying signed PUT TempURL, plus knowledge of the target container and object name. The target object must be in the same account that owns the account-level key used to sign the TempURL.
3
What can be done if the middleware cannot be patched immediately?
Operators can add x-copy-from to the incoming_remove_headers option in the [filter:tempurl] section of the proxy server configuration. This prevents the X-Copy-From header from being used in the affected request flow.