CVE-2026-97149 in Swift
Summary
by MITRE • 09/24/2026
In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability in OpenStack Swift prior to version 2.38.2 represents a critical authentication bypass within the tempurl middleware, specifically affecting PUT requests that utilize temporary URLs for object storage operations. The core technical flaw lies in the scope of the cryptographic signature applied to these temporary URLs. When an administrator generates a TempURL with write permissions, the resulting HMAC signature is calculated exclusively over three specific components: the HTTP method, the expiration timestamp, and the request path. This design choice creates a significant security gap because it fails to incorporate any headers present in the incoming HTTP request into the integrity check. Consequently, while the signature guarantees that the requester has permission to write to the specified object at the given time, it provides no assurance regarding the content or metadata of that PUT operation.
This architectural limitation allows an attacker possessing a valid PUT TempURL for a specific target object to manipulate the request by injecting additional headers before sending it to the Swift proxy server. Specifically, the vulnerability centers on the X-Copy-From header, which instructs the copy middleware to replicate data from another existing object within the same account into the destination specified in the URL path. Because this header is not part of the signed payload, its presence does not invalidate the TempURL signature. The proxy server validates the signature against the method, expiry, and path, finds them correct, and proceeds to execute the request. This effectively bypasses the intended access controls that restrict users from modifying arbitrary objects within their account, as the attacker can leverage a limited write permission on one object to read data from another entirely different object they do not have explicit read permissions for.
The operational impact of this vulnerability is severe, enabling unauthorized data exfiltration across an OpenStack Swift tenant's storage namespace. An attacker who has obtained or forged a PUT TempURL with sufficient expiration time can target any other object within the same account by setting the X-Copy-From header to that object's path. Once the copy operation completes successfully via the middleware, the previously protected data is duplicated into the destination object controlled by the attacker. The attacker then utilizes a GET TempURL for this newly copied destination object to retrieve and exfiltrate the sensitive information. This attack vector effectively neutralizes the isolation guarantees provided by account-level permissions, allowing lateral movement within an account's storage space without requiring additional authentication credentials or elevated privileges beyond what was originally granted via the temporary URL.
Mitigation strategies must address both the immediate software defect and broader architectural assumptions regarding signed requests. The primary remediation is to upgrade OpenStack Swift to version 2.38.2 or later, where this specific header validation logic has been corrected to ensure that critical headers like X-Copy-From are included in the signature calculation or explicitly rejected when present on PUT TempURLs. For deployments unable to patch immediately, administrators should review their proxy pipeline configurations. The vulnerability only affects environments using the default shipped proxy pipeline which includes both tempurl and copy middleware with account-level keys. Disabling the copy middleware for public-facing endpoints or restricting the use of TempURLs to read-only operations can reduce exposure. Furthermore, organizations should adopt a principle of least privilege by ensuring that temporary URLs are granted minimal necessary permissions and have short expiration windows to limit the attack window.
From a classification perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, as the system fails to properly verify the integrity of the request context beyond the basic URL parameters. It also relates to CWE-693, Protection Mechanism Failure, because the security control designed to prevent unauthorized actions (the TempURL signature) is bypassed due to incomplete validation logic. In terms of offensive tactics, this exploit maps directly to MITRE ATT&CK technique T1530, Data from Cloud Storage Object, specifically illustrating how attackers can abuse storage APIs and misconfigured access controls to harvest data without direct read permissions. The incident underscores the importance of ensuring that all mutable aspects of an HTTP request are covered by integrity checks when using signed URLs for write operations in cloud infrastructure environments.