CVE-2026-71192

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71192", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-08-05T05:05:32.904Z", "datePublished": "2026-08-05T05:05:33.267Z", "dateUpdated": "2026-08-05T13:31:30.582Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Swift", "repo": "https://opendev.org/openstack/swift", "vendor": "OpenStack", "versions": [{"lessThan": "2.35.4", "status": "affected", "version": "2.18.0", "versionType": "semver"}, {"lessThan": "2.36.3", "status": "affected", "version": "2.36.0", "versionType": "semver"}, {"lessThan": "2.37.3", "status": "affected", "version": "2.37.0", "versionType": "semver"}, {"status": "affected", "version": "2.38.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An\nattacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3_acl=true configuration."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-05T05:05:33.267Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://launchpad.net/bugs/2158733"}, {"tags": ["vendor-advisory", "mailing-list"], "url": "https://openwall.com/lists/oss-security/2026/07/28/26"}, {"tags": ["vendor-advisory"], "url": "https://security.openstack.org/ossa/OSSA-2026-030.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.18.0", "versionEndExcluding": "2.35.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.36.0", "versionEndExcluding": "2.36.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.37.0", "versionEndExcluding": "2.37.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.38.0", "versionEndIncluding": "2.38.0"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T13:31:24.534760Z", "id": "CVE-2026-71192", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:31:30.582Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71192", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T13:31:24.534760Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:31:27.666Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://opendev.org/openstack/swift", "vendor": "OpenStack", "product": "Swift", "versions": [{"status": "affected", "version": "2.18.0", "lessThan": "2.35.4", "versionType": "semver"}, {"status": "affected", "version": "2.36.0", "lessThan": "2.36.3", "versionType": "semver"}, {"status": "affected", "version": "2.37.0", "lessThan": "2.37.3", "versionType": "semver"}, {"status": "affected", "version": "2.38.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://launchpad.net/bugs/2158733", "tags": ["issue-tracking"]}, {"url": "https://openwall.com/lists/oss-security/2026/07/28/26", "tags": ["vendor-advisory", "mailing-list"]}, {"url": "https://security.openstack.org/ossa/OSSA-2026-030.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An\nattacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3_acl=true configuration."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.35.4", "versionStartIncluding": "2.18.0"}, {"criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.36.3", "versionStartIncluding": "2.36.0"}, {"criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.37.3", "versionStartIncluding": "2.37.0"}, {"criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.38.0", "versionStartIncluding": "2.38.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-05T05:05:33.267Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71192", "state": "PUBLISHED", "dateUpdated": "2026-08-05T13:31:30.582Z", "dateReserved": "2026-08-05T05:05:32.904Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-08-05T05:05:33.267Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Swift", "repo": "https://opendev.org/openstack/swift", "vendor": "OpenStack", "versions": [{"lessThan": "2.35.4", "status": "affected", "version": "2.18.0", "versionType": "semver"}, {"lessThan": "2.36.3", "status": "affected", "version": "2.36.0", "versionType": "semver"}, {"lessThan": "2.37.3", "status": "affected", "version": "2.37.0", "versionType": "semver"}, {"status": "affected", "version": "2.38.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An\nattacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3_acl=true configuration."}, {"lang": "es", "value": "En OpenStack Swift hasta la versi\u00f3n 2.38.0, el middleware S3API no sanitiza los encabezados de control nativos de Swift (X-Copy-From, X-Copy-From-Account) de las solicitudes de la API S3 cuando s3_acl=true. Un atacante puede inyectar estos encabezados en una solicitud PUT firmada dirigida a su propio bucket, haciendo que Swift realice una copia del lado del servidor de un objeto privado de otro inquilino. La autorizaci\u00f3n del objeto de origen se omite porque el middleware S3API ya ha autorizado la solicitud contra el destino. El atacante puede leer cualquier objeto cuyo project_id, nombre de contenedor y nombre de objeto sean conocidos, independientemente de las ACLs o la propiedad del objeto de origen. Esto requiere la configuraci\u00f3n no predeterminada s3_acl=true."}], "id": "CVE-2026-71192", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71192", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T13:31:24.534760Z", "version": "2.0.3"}}]}, "published": "2026-08-05T06:16:40.333", "references": [{"source": "cve@mitre.org", "url": "https://launchpad.net/bugs/2158733"}, {"source": "cve@mitre.org", "url": "https://openwall.com/lists/oss-security/2026/07/28/26"}, {"source": "cve@mitre.org", "url": "https://security.openstack.org/ossa/OSSA-2026-030.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"acknowledgement": "Upstream acknowledges Christian Schwede (NVIDIA) as the original reporter.", "bugzilla": {"description": "openstack-swift: openstack-swift: S3API cross-tenant object read via Swift-native header injection", "id": "2503678", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503678"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-863", "details": ["A flaw was found in the S3API middleware of OpenStack Swift. When configured with s3_acl=true (non-default), Swift-native control headers such as X-Copy-From and X-Copy-From-Account are not sanitized from S3 API requests. Because the S3 ACL mode bypasses Swift's native authorization, an authenticated attacker can inject these headers to read objects from other tenants' storage. The attacker needs prior knowledge of the target project_id, container name, and object name."], "mitigation": {"lang": "en:us", "value": "Ensure the s3_acl configuration option is set to false (the default) in the [filter:s3api] section of proxy-server.conf. This completely mitigates the vulnerability because Swift's native authorization (Keystone/tempauth) will properly deny cross-tenant access attempts. If s3_acl=true is required and cannot be changed, restrict S3 API access to trusted networks or remove the s3api filter from the proxy-server pipeline until the patch is applied."}, "name": "CVE-2026-71192", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "package_name": "rhosp13/openstack-swift-account", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "package_name": "rhosp13/openstack-swift-base", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "package_name": "rhosp13/openstack-swift-container", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "package_name": "rhosp13/openstack-swift-object", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "package_name": "rhosp13/openstack-swift-proxy-server", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "openstack-swift", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "rhosp-rhel8/openstack-swift-account", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "rhosp-rhel8/openstack-swift-base", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "rhosp-rhel8/openstack-swift-container", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "rhosp-rhel8/openstack-swift-object", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "rhosp-rhel8/openstack-swift-proxy-server", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "openstack-swift", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "rhosp-rhel9/openstack-swift-account", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "rhosp-rhel9/openstack-swift-base", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "rhosp-rhel9/openstack-swift-container", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "rhosp-rhel9/openstack-swift-object", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "rhosp-rhel9/openstack-swift-proxy-server", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "openstack-swift", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "rhoso/openstack-swift-account-rhel9", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "rhoso/openstack-swift-base-rhel9", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "rhoso/openstack-swift-container-rhel9", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "rhoso/openstack-swift-object-rhel9", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "rhoso/openstack-swift-proxy-server-rhel9", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-07-28T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71192\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71192\nhttps://launchpad.net/bugs/2158733"], "statement": "Red Hat OpenStack Platform (RHOSP) and Red Hat OpenStack Services on OpenShift (RHOSO) ship openstack-swift. This vulnerability requires the non-default s3_acl=true configuration, which the upstream documentation explicitly warns is experimental ('DON'T USE THIS for production before enough testing'). In default RHOSO deployments, s3_acl is not set, defaulting to false. Swift's native Keystone authorization properly denies cross-tenant access in this configuration. Deployments using the default s3_acl=false configuration are not affected. Only deployments that have explicitly set s3_acl=true in the [filter:s3api] section of proxy-server.conf are vulnerable.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.18.0,2.35.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.36.0,2.36.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.37.0,2.37.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.38.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Swift", "source": "cna", "vendor": "OpenStack"}, "product": "swift", "vendor": "openstack"}], "created": "2026-08-05T06:30:03.092552+00:00", "title": "S3API Middleware Allows Unauthorized Server\u2011Side Copy in OpenStack Swift", "updated": "2026-08-05T09:00:05.027780+00:00", "vendors": ["openstack", "openstack$PRODUCT$swift"]}