CVE-2026-71191 in Swift
Summary
by MITRE • 08/05/2026
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in OpenStack Swift versions 2.38.0 and earlier represents a critical authorization bypass flaw within the S3API middleware implementation that directly impacts the security of object storage operations. This issue stems from insufficient validation of signature verification for semantic x-amz-* headers when processing presigned URL requests, creating a pathway for unauthorized access to storage objects through carefully crafted malicious requests. The vulnerability specifically affects deployments configured with the default s3_acl=false setting, which is commonly used in production environments.
The technical flaw manifests when an attacker exploits the incomplete signature validation mechanism by injecting unsigned X-Amz-Copy-Source headers into presigned PUT requests. This allows the middleware to process server-side copy operations using the authorization context of the original signer rather than validating all header parameters against the signature. The vulnerability falls under CWE-284, which addresses insufficient access control mechanisms, specifically targeting improper authorization enforcement in API request processing. When a presigned URL is generated with the necessary permissions, an attacker can manipulate additional headers to redirect the copy operation to arbitrary source objects within the same project context.
The operational impact of this vulnerability extends beyond simple unauthorized data access, as it enables attackers to perform lateral movement within storage systems by reading objects they would normally not have access to. The attack requires knowledge of the target project_id, container name, and object name but does not require additional authentication credentials for the source objects. This makes the attack surface particularly dangerous in multi-tenant environments where different users share the same project space. The vulnerability can be exploited through standard S3-compatible API calls and requires no special privileges beyond obtaining a valid presigned URL.
The security implications align with ATT&CK technique T1078.004, which covers valid accounts usage for persistence and privilege escalation, as attackers leverage legitimate signed URLs to gain access to unauthorized resources. Organizations using OpenStack Swift in default configurations are particularly vulnerable since the issue affects the core middleware functionality without requiring additional components or services to be compromised. The attack vector is especially concerning because it operates within legitimate API request processing flows, making detection more difficult and potentially allowing for extended periods of unauthorized access before discovery.
Mitigation strategies should focus on updating OpenStack Swift installations to versions that properly validate all semantic x-amz-* headers against the SigV4 signature, implementing additional header validation checks in middleware components, and ensuring that presigned URL generation includes comprehensive header parameter validation. Organizations should also consider implementing network-level monitoring to detect unusual patterns of server-side copy operations and establish stricter access controls for sensitive project resources. The recommended approach involves configuring the S3API middleware to enforce strict header signature validation and implementing additional logging mechanisms to track all copy operations within storage systems.