OpenStack Swift up to 2.35.4/2.36.3/2.37.3/2.38.1 Tempurl X-Copy-From privileges management

Summaryinfo

A vulnerability described as critical has been identified in OpenStack Swift up to 2.35.4/2.36.3/2.37.3/2.38.1. This affects an unknown function of the component Tempurl. Such manipulation of the argument X-Copy-From leads to privileges management. This vulnerability is traded as CVE-2026-97149. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in OpenStack Swift up to 2.35.4/2.36.3/2.37.3/2.38.1. It has been rated as critical. Affected by this issue is an unknown code block of the component Tempurl. The manipulation of the argument X-Copy-From with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected.

The advisory is available at launchpad.net. This vulnerability is handled as CVE-2026-97149 since 09/24/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading to version 2.35.5, 2.36.4, 2.37.4 or 2.38.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Cloud Software

Vendor

• OpenStack

Name

• Swift

Version

• 2.35.0
• 2.35.1
• 2.35.2
• 2.35.3
• 2.35.4
• 2.36.0
• 2.36.1
• 2.36.2
• 2.36.3
• 2.37.0
• 2.37.1
• 2.37.2
• 2.37.3
• 2.38.0
• 2.38.1

License

• free

Website

• Vendor: https://www.openstack.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion