CVE-2026-71191

In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target projectid, container name, and object name are known. This affects all deployments using the default s3acl=false configuration.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.18.0"
                },
                {
                    "fixed": "2.35.4"
                },
                {
                    "introduced": "2.36.0"
                },
                {
                    "fixed": "2.36.3"
                },
                {
                    "introduced": "2.37.0"
                },
                {
                    "fixed": "2.37.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71191.json",
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-863"
    ]
}

References

Affected packages

Git / opendev.org/openstack/swift

Affected ranges

Type

GIT

Repo

https://opendev.org/openstack/swift

Events

Introduced

9f5881d5143fd06a328bde2713cd9c61df579289

Last affected

9f5881d5143fd06a328bde2713cd9c61df579289

Database specific

{
    "extracted_events": [
        {
            "introduced": "2.38.0"
        },
        {
            "last_affected": "2.38.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

2.*

2.38.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71191.json"