Vulnerability · Published Sep 21, 2026 · Assigned by redhat

CVE-2026-94368Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header

High 7.1

In plain English

A high-severity security flaw in Red Hat Openshift Data Foundation 4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 86.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 (SigV4). Due to improper validation, the service fails to reject requests containing unsigned x-amz- headers, instead simply dropping them from the signature calculation. This allows an attacker who possesses a valid presigned PUT URL to add an unsigned x-amz-copy-source header, effectively converting a simple upload into a CopyObject operation. This can lead to unauthorized access and copying of any data the original signer is permitted to reach across the entire storage system.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Openshift Data Foundation 4	see references
Red Hat	Red Hat Openshift Data Foundation 4	see references

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2026-94368 vdb-entry, x_refsource_REDHAT
RHBZ#2537364 issue-tracking, x_refsource_REDHAT