OpenStack Swift S3API s3_acl=true header injection bypass (2.38.0)
CVE-2026-71192 Published on August 5, 2026
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3_acl=true configuration.
Vulnerability Analysis
CVE-2026-71192 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-71192 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-71192
Want to know whenever a new CVE is published for OpenStack Swift? stack.watch will email you.
Affected Versions
OpenStack Swift:- Version 2.18.0 and below 2.35.4 is affected.
- Version 2.36.0 and below 2.36.3 is affected.
- Version 2.37.0 and below 2.37.3 is affected.
- Version 2.38.0 is affected.