CVE-2026-50221

{"id": "CVE-2026-50221", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50221", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T17:38:21.427291Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"repo": "https://opendev.org/openstack/swift", "vendor": "OpenStack", "product": "Swift", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.35.3", "versionType": "semver"}, {"status": "affected", "version": "2.36.0", "lessThan": "2.36.2", "versionType": "semver"}, {"status": "affected", "version": "2.37.0", "lessThan": "2.37.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-23T18:18:04.440", "references": [{"url": "https://launchpad.net/bugs/2150261", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-024.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2026/06/23/5", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/23/5", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to redirect container update requests to an attacker-controlled server, enabling server-side request forgery. The SSRF requests expose internal cluster metadata including storage policy indexes, partition mappings, device names, and when at rest encryption is enabled, cipher text and initialization vectors for the container-level encryption key. The attacker can also cause \"ghost listings\" in arbitrary containers via the shard-range redirect mechanism."}, {"lang": "es", "value": "En OpenStack Swift anterior a 2.37.2, proxy-server no elimina las cabeceras de actualizaci\u00f3n internas (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) de las peticiones del cliente antes de reenviarlas a los servidores de objetos. Un usuario autenticado con acceso de escritura puede inyectar estas cabeceras para redirigir las peticiones de actualizaci\u00f3n del contenedor a un servidor controlado por el atacante, lo que permite la falsificaci\u00f3n de petici\u00f3n del lado del servidor. Las peticiones SSRF exponen metadatos internos del cl\u00faster, incluyendo \u00edndices de pol\u00edticas de almacenamiento, mapeos de particiones, nombres de dispositivos y, cuando el cifrado en reposo est\u00e1 habilitado, texto cifrado y vectores de inicializaci\u00f3n para la clave de cifrado a nivel de contenedor. El atacante tambi\u00e9n puede causar \u2019listados fantasma\u2019 en contenedores arbitrarios a trav\u00e9s del mecanismo de redirecci\u00f3n de rango de fragmentos."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E55A646-6E82-433A-8CCE-264334D5EF76", "versionEndExcluding": "2.35.3", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF8B39A3-B72E-4837-9CB3-F437EAC84F4B", "versionEndExcluding": "2.36.2", "versionStartIncluding": "2.36.0"}, {"criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "581FC644-8499-4750-B70D-C726C5D15E11", "versionEndExcluding": "2.37.2", "versionStartIncluding": "2.37.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}