Signature Verification Flaw in NooBaa Multicloud Object Gateway Allows Unauthorized Data Access
CVE-2026-94368
7.1HIGH
What is CVE-2026-94368?
A vulnerability exists in the signature verification logic of the NooBaa Multicloud Object Gateway's core component. This flaw occurs during the processing of S3 presigned URLs using Signature Version 4. The service fails to validate requests containing unsigned x-amz- headers effectively, allowing attackers who possess valid presigned PUT URLs to exploit this weakness. By appending an unsigned x-amz-copy-source header, an attacker can convert standard upload operations into CopyObject operations, resulting in unauthorized access and potential data exfiltration across the entire storage infrastructure.
References
CVSS V3.1
Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Oren Yomtov (act.security) for reporting this issue.