Auth bypass in Openstack Swift
CVE-2026-71192
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An attacker can inject these headers into a signed PUT request…
Vulnerability class: Broken Access Control
Affected products
- Openstack Swift — versions 2.18.0, 2.36.0, 2.37.0
Weakness classification (CWE)
References
- cve@mitre.org (issue-tracking)
- cve@mitre.org (mailing-list, vendor-advisory)
- cve@mitre.org (vendor-advisory)