CVE-2026-71191

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71191", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-08-05T05:01:20.566Z", "datePublished": "2026-08-05T05:01:20.971Z", "dateUpdated": "2026-08-06T13:10:38.459Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Swift", "repo": "https://opendev.org/openstack/swift", "vendor": "OpenStack", "versions": [{"lessThan": "2.35.4", "status": "affected", "version": "2.18.0", "versionType": "semver"}, {"lessThan": "2.36.3", "status": "affected", "version": "2.36.0", "versionType": "semver"}, {"lessThan": "2.37.3", "status": "affected", "version": "2.37.0", "versionType": "semver"}, {"status": "affected", "version": "2.38.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-05T05:01:20.971Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://launchpad.net/bugs/2158733"}, {"tags": ["mailing-list", "vendor-advisory"], "url": "https://openwall.com/lists/oss-security/2026/07/28/26"}, {"tags": ["vendor-advisory"], "url": "https://security.openstack.org/ossa/OSSA-2026-030.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.18.0", "versionEndExcluding": "2.35.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.36.0", "versionEndExcluding": "2.36.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.37.0", "versionEndExcluding": "2.37.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.38.0", "versionEndIncluding": "2.38.0"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T13:10:29.357812Z", "id": "CVE-2026-71191", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T13:10:38.459Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71191", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T13:10:29.357812Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T13:10:34.684Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://opendev.org/openstack/swift", "vendor": "OpenStack", "product": "Swift", "versions": [{"status": "affected", "version": "2.18.0", "lessThan": "2.35.4", "versionType": "semver"}, {"status": "affected", "version": "2.36.0", "lessThan": "2.36.3", "versionType": "semver"}, {"status": "affected", "version": "2.37.0", "lessThan": "2.37.3", "versionType": "semver"}, {"status": "affected", "version": "2.38.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://launchpad.net/bugs/2158733", "tags": ["issue-tracking"]}, {"url": "https://openwall.com/lists/oss-security/2026/07/28/26", "tags": ["mailing-list", "vendor-advisory"]}, {"url": "https://security.openstack.org/ossa/OSSA-2026-030.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.35.4", "versionStartIncluding": "2.18.0"}, {"criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.36.3", "versionStartIncluding": "2.36.0"}, {"criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.37.3", "versionStartIncluding": "2.37.0"}, {"criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.38.0", "versionStartIncluding": "2.38.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-05T05:01:20.971Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71191", "state": "PUBLISHED", "dateUpdated": "2026-08-06T13:10:38.459Z", "dateReserved": "2026-08-05T05:01:20.566Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-08-05T05:01:20.971Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Swift", "repo": "https://opendev.org/openstack/swift", "vendor": "OpenStack", "versions": [{"lessThan": "2.35.4", "status": "affected", "version": "2.18.0", "versionType": "semver"}, {"lessThan": "2.36.3", "status": "affected", "version": "2.36.0", "versionType": "semver"}, {"lessThan": "2.37.3", "status": "affected", "version": "2.37.0", "versionType": "semver"}, {"status": "affected", "version": "2.38.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration."}, {"lang": "es", "value": "En OpenStack Swift hasta la versi\u00f3n 2.38.0, el middleware S3API no garantiza que los encabezados sem\u00e1nticos x-amz-* est\u00e9n cubiertos por la firma SigV4 en las solicitudes de URL pre-firmadas. Un atacante que obtiene una URL PUT pre-firmada puede inyectar un encabezado X-Amz-Copy-Source sin firmar, haciendo que Swift realice una copia del lado del servidor desde un objeto de origen arbitrario utilizando el contexto de autorizaci\u00f3n del firmante. El atacante puede leer cualquier objeto al que el firmante tiene acceso, siempre que se conozcan el project_id de destino, el nombre del contenedor y el nombre del objeto. Esto afecta a todas las implementaciones que utilizan la configuraci\u00f3n predeterminada s3_acl=false."}], "id": "CVE-2026-71191", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71191", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T13:10:29.357812Z", "version": "2.0.3"}}]}, "published": "2026-08-05T06:16:40.180", "references": [{"source": "cve@mitre.org", "url": "https://launchpad.net/bugs/2158733"}, {"source": "cve@mitre.org", "url": "https://openwall.com/lists/oss-security/2026/07/28/26"}, {"source": "cve@mitre.org", "url": "https://security.openstack.org/ossa/OSSA-2026-030.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"acknowledgement": "Upstream acknowledges Christian Schwede (NVIDIA) as the original reporter.", "bugzilla": {"description": "openstack-swift: openstack-swift: S3API presigned URL unsigned header authorization bypass", "id": "2503670", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503670"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-863", "details": ["A flaw was found in the S3API middleware of OpenStack Swift. The SigV4 presigned URL implementation does not require that semantic x-amz-* headers be included in the request signature. An attacker who obtains a presigned PUT URL can inject unsigned headers such as X-Amz-Copy-Source to copy objects from the signer's storage, bypassing the intended scope of the presigned URL authorization. The attacker needs prior knowledge of the target project_id, container name, and object name."], "mitigation": {"lang": "en:us", "value": "If S3 API compatibility is not required, remove the s3api filter from the proxy-server pipeline in proxy-server.conf. This completely eliminates the attack surface. If S3 API is required, restrict the distribution and scope of presigned PUT URLs as an operational control, and apply the upstream patch when available. There is no configuration-only workaround that fully mitigates this issue while keeping S3 API functionality enabled."}, "name": "CVE-2026-71191", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Will not fix", "package_name": "rhosp13/openstack-swift-account", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Will not fix", "package_name": "rhosp13/openstack-swift-base", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Will not fix", "package_name": "rhosp13/openstack-swift-container", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Will not fix", "package_name": "rhosp13/openstack-swift-object", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Will not fix", "package_name": "rhosp13/openstack-swift-proxy-server", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "openstack-swift", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "rhosp-rhel8/openstack-swift-account", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "rhosp-rhel8/openstack-swift-base", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "rhosp-rhel8/openstack-swift-container", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "rhosp-rhel8/openstack-swift-object", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "rhosp-rhel8/openstack-swift-proxy-server", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "openstack-swift", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "rhosp-rhel9/openstack-swift-account", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "rhosp-rhel9/openstack-swift-base", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "rhosp-rhel9/openstack-swift-container", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "rhosp-rhel9/openstack-swift-object", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "rhosp-rhel9/openstack-swift-proxy-server", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "openstack-swift", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "rhoso/openstack-swift-account-rhel9", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "rhoso/openstack-swift-base-rhel9", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "rhoso/openstack-swift-container-rhel9", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "rhoso/openstack-swift-object-rhel9", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "rhoso/openstack-swift-proxy-server-rhel9", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-07-28T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71191\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71191\nhttps://launchpad.net/bugs/2158733"], "statement": "Red Hat OpenStack Platform (RHOSP) and Red Hat OpenStack Services on OpenShift (RHOSO) ship openstack-swift and are affected by this vulnerability. In default RHOSO deployments, the s3api filter is included in the active proxy-server pipeline, and the s3_acl option is not explicitly set (defaulting to false). SigV4 presigned URL requests are processed through the S3API middleware and are vulnerable. All RHOSP (13, 16.2, 17.1) and RHOSO (18.0) deployments with s3api enabled in the pipeline are affected.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.18.0,2.35.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.36.0,2.36.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.37.0,2.37.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.38.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Swift", "source": "cna", "vendor": "OpenStack"}, "product": "swift", "vendor": "openstack"}], "created": "2026-08-05T06:30:03.092706+00:00", "title": "Unsigned X-Amz-Copy-Source Header Injection in OpenStack Swift S3API Presigned URLs", "updated": "2026-08-05T07:00:09.747736+00:00", "vendors": ["openstack", "openstack$PRODUCT$swift"]}