EUVD-2026-38537
GHSA-h8rc-w822-q8vq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible proxy-server requires low-privilege authenticated access; scope changes because object servers are caused to make requests, yielding partial confidentiality disclosure of internal infrastructure.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Server-side request forgery in OpenStack Swift's proxy-server allows authenticated users to manipulate object servers into issuing outbound HTTP requests to attacker-specified hosts. All Swift deployments running version 2.0.0 or later across all maintained release trains are affected, including the 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, and development 2026.2/hibiscus branches. No public exploit has been identified at time of analysis, but successful exploitation could expose internal infrastructure topology, metadata services, or other resources reachable from the object server tier.
Technical ContextAI
OpenStack Swift is a distributed object storage system structured around a proxy-server layer that authenticates and routes client requests to backend object servers. The vulnerability arises from insufficient sanitization of HTTP headers at the proxy-server tier: an authenticated client can inject headers that cause the proxy to direct an object server to issue outbound HTTP requests to an attacker-controlled or internal destination. This exploits the implicit trust relationship between the proxy and object server tiers - the object server acts on instructions embedded in forwarded headers without independently validating their legitimacy. The root cause aligns with CWE-918 (Server-Side Request Forgery), though no CWE was formally assigned in the advisory. No CPE strings were provided, but affected versions are explicitly enumerated as >=2.0.0 <2.35.3, >=2.36.0 <2.36.2, and >=2.37.0 <2.37.2.
RemediationAI
Upstream fixes have been submitted via OpenDev code review for all maintained branches: 2026.2/hibiscus at https://review.opendev.org/994449, 2026.1/gazpacho at https://review.opendev.org/994450, 2025.2/flamingo at https://review.opendev.org/994451, and 2025.1/epoxy at https://review.opendev.org/994452. These are upstream patch submissions rather than tagged release artifacts, so exact packaged release versions have not been independently confirmed from the available data - operators should monitor https://security.openstack.org/ossa/OSSA-2026-024.html for distribution-packaged updates. As a compensating control prior to patching, implement strict egress filtering on Swift object server hosts to allow outbound HTTP/HTTPS only to required destinations (e.g., other Swift nodes, identity endpoints); this directly limits SSRF reachability without requiring application changes, though it may require careful allowlisting to avoid disrupting legitimate object server federation traffic. Additionally, audit Swift user accounts to ensure only trusted identities hold proxy-server access.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through cra
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today