Vulnerability · Published Aug 5, 2026 · Assigned by mitre
CVE-2026-71192
Medium 6.0
In plain English
A medium-severity incorrect authorization in Swift from OpenStack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3_acl=true configuration.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | swift | 2.30.1-0+deb12u3 | DEBIAN-CVE-2026-71192 |
| Debian:13 | swift | 2.35.1-0+deb13u3 | DEBIAN-CVE-2026-71192 |
| Debian:14 | swift | 2.37.1-6 | DEBIAN-CVE-2026-71192 |
| Ubuntu:22.04:LTS | swift | no fix listed | UBUNTU-CVE-2026-71192 |
| Ubuntu:24.04:LTS | swift | no fix listed | UBUNTU-CVE-2026-71192 |
| Ubuntu:26.04:LTS | swift | no fix listed | UBUNTU-CVE-2026-71192 |
| Ubuntu:26.10 | swift | no fix listed | UBUNTU-CVE-2026-71192 |
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://launchpad.net/bugs/2158733 issue-tracking
- https://openwall.com/lists/oss-security/2026/07/28/26 vendor-advisory, mailing-list
- https://security.openstack.org/ossa/OSSA-2026-030.html vendor-advisory