EUVD-2026-53050
GHSA-6p2v-36c6-f6m5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Non-default s3_acl=true required (AC:H); valid S3 tenant credential needed (PR:L); cross-tenant data access represents a scope change (S:C) with high confidentiality impact only.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3_acl=true configuration.
AnalysisAI
Cross-tenant object exfiltration in OpenStack Swift through 2.38.0 allows authenticated S3 API users to bypass source-object authorization by injecting Swift-native server-side copy headers (X-Copy-From, X-Copy-From-Account) into a signed S3 PUT request. The S3API middleware authorizes the request against the attacker-controlled destination bucket and then forwards the copy headers to Swift's copy engine, which executes the cross-tenant copy without re-evaluating the source object's ACLs or ownership - a classic confused-deputy flaw (CWE-863). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the OpenStack Swift S3API middleware to be explicitly configured with s3_acl=true, a non-default option; any deployment using the default s3_acl=false is not affected, and this is the single most important limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, score 6.0) accurately reflects the threat profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix documented in OSSA-2026-030 (https://security.openstack.org/ossa/OSSA-2026-030.html); a specific patched release version number is not present in the available data and has not been independently confirmed - operators should monitor the OpenStack release channels and the Launchpad bug (https://launchpad.net/bugs/2158733) for the exact fixed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing
An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubn
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
Remote unauthenticated denial of service in OpenStack Swift through 2.38.0 allows any network-reachable attacker to exha
OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close serv
OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers
Isode SWIFT v4.0.2 was discovered to contain hard-coded credentials in the Registry Editor. Rated high severity (CVSS 7.
A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious
A stack overflow issue existed in Swift for Linux. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
Denial of service in OpenStack Swift's s3api middleware allows an authenticated S3 API user to permanently hang proxy-se
OpenStack Swift's S3API middleware through version 2.38.0 fails to enforce SigV4 signature coverage over semantic x-amz-
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today