Bug 2503678 (CVE-2026-71192)

Summary:	CVE-2026-71192 openstack-swift: openstack-swift: S3API cross-tenant object read via Swift-native header injection
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	eglynn, jjoyce, jpretori, jschluet, lhh, mburns, mgarciac, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the S3API middleware of OpenStack Swift. When configured with s3_acl=true (non-default), Swift-native control headers such as X-Copy-From and X-Copy-From-Account are not sanitized from S3 API requests. Because the S3 ACL mode bypasses Swift's native authorization, an authenticated attacker can inject these headers to read objects from other tenants' storage. The attacker needs prior knowledge of the target project_id, container name, and object name.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-07-28

Description OSIDB Bzimport 2026-07-21 15:29:02 UTC

A flaw was found in the S3API middleware of OpenStack Swift. When configured with s3_acl=true (non-default), the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account, X-Symlink-Target, X-Symlink-Target-Account, X-Object-Manifest, X-Static-Large-Object) from incoming S3 API requests. When s3_acl=true, the S3AclRequest class sets swift.authorize_override=True, bypassing Swift's native authorization. Since the S3 ACL system does not understand these native Swift headers, an authenticated attacker can inject X-Copy-From and X-Copy-From-Account headers to copy objects from other tenants' storage into their own account. The attacker must know the target project_id, container name, and object name.

The vulnerability is in S3AclRequest.to_swift_req() (s3request.py) which disables native Swift auth, combined with S3Request.__init__() not stripping native Swift control headers from incoming requests.

Affected versions: >=2.18.0 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3
Fix commit: 0e4a334aa41980b0ae0c7f2244ddfa8c3c24e5db

Reporter: Christian Schwede (NVIDIA), reported via OpenStack VMT
PSIRT Ticket: PSIRTSUPT-19763
Upstream private report: https://launchpad.net/bugs/2158733