CVE-2026-71191

In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.

CVSS

No CVSS.

References

Link	Resource
https://launchpad.net/bugs/2158733
https://openwall.com/lists/oss-security/2026/07/28/26
https://security.openstack.org/ossa/OSSA-2026-030.html

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) En OpenStack Swift hasta la versión 2.38.0, el middleware S3API no garantiza que los encabezados semánticos x-amz-* estén cubiertos por la firma SigV4 en las solicitudes de URL pre-firmadas. Un atacante que obtiene una URL PUT pre-firmada puede inyectar un encabezado X-Amz-Copy-Source sin firmar, haciendo que Swift realice una copia del lado del servidor desde un objeto de origen arbitrario utilizando el contexto de autorización del firmante. El atacante puede leer cualquier objeto al que el firmante tiene acceso, siempre que se conozcan el project_id de destino, el nombre del contenedor y el nombre del objeto. Esto afecta a todas las implementaciones que utilizan la configuración predeterminada s3_acl=false.

Information

Published : 2026-08-05 06:16

Updated : 2026-10-24 15:10

NVD link : CVE-2026-71191

Mitre link : CVE-2026-71191

CVE.ORG link : CVE-2026-71191

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-71191", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71191", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T13:10:29.357812Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"repo": "https://opendev.org/openstack/swift", "vendor": "OpenStack", "product": "Swift", "versions": [{"status": "affected", "version": "2.18.0", "lessThan": "2.35.4", "versionType": "semver"}, {"status": "affected", "version": "2.36.0", "lessThan": "2.36.3", "versionType": "semver"}, {"status": "affected", "version": "2.37.0", "lessThan": "2.37.3", "versionType": "semver"}, {"status": "affected", "version": "2.38.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-05T06:16:40.180", "references": [{"url": "https://launchpad.net/bugs/2158733", "source": "cve@mitre.org"}, {"url": "https://openwall.com/lists/oss-security/2026/07/28/26", "source": "cve@mitre.org"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-030.html", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration."}, {"lang": "es", "value": "En OpenStack Swift hasta la versi\u00f3n 2.38.0, el middleware S3API no garantiza que los encabezados sem\u00e1nticos x-amz-* est\u00e9n cubiertos por la firma SigV4 en las solicitudes de URL pre-firmadas. Un atacante que obtiene una URL PUT pre-firmada puede inyectar un encabezado X-Amz-Copy-Source sin firmar, haciendo que Swift realice una copia del lado del servidor desde un objeto de origen arbitrario utilizando el contexto de autorizaci\u00f3n del firmante. El atacante puede leer cualquier objeto al que el firmante tiene acceso, siempre que se conozcan el project_id de destino, el nombre del contenedor y el nombre del objeto. Esto afecta a todas las implementaciones que utilizan la configuraci\u00f3n predeterminada s3_acl=false."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "cve@mitre.org"}