S3API Middleware Vulnerability in OpenStack Swift Affects Data Security

CVE-2026-71191

What is CVE-2026-71191?

The S3API middleware in OpenStack Swift up to version 2.38.0 is susceptible to a vulnerability that fails to enforce semantic x-amz-* headers within the SigV4 signature for presigned URL requests. This allows attackers to exploit the situation by using a presigned PUT URL to inject an unsigned X-Amz-Copy-Source header. Consequently, the Swift service may conduct server-side copying from an arbitrary source object based on the signer's authorization context. If attackers are aware of the target project_id, container name, and object name, they can read any object accessible by the signer, potentially leading to serious data breaches across deployments utilizing the default s3_acl=false configuration.

References