CVE-2026-71191 OpenStack CVE debrief

Who should care

OpenStack Swift users and administrators, especially those with default s3_acl=false configuration, should be aware of this vulnerability. Operators of OpenStack Swift, security teams, and vulnerability management teams need to assess their exposure and take appropriate actions. This includes reviewing configurations, monitoring for suspicious activity, and applying patches if necessary. The vulnerability's impact on data confidentiality and potential for unauthorized data access make it a priority for teams responsible for data security and compliance to address this issue promptly.

Technical summary

In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. This allows the attacker to read any object the signer has access to, provided the target project_id, container name, and object name are known. The vulnerability affects all deployments using the default s3_acl=false configuration, and its impact is heightened in environments where sensitive data is stored.

Defensive priority

Medium priority given the CVSS score of 6 and the potential for data exposure.

Recommended defensive actions

• Verify OpenStack Swift version and apply patches if necessary
• Review and update S3API middleware configurations
• Monitor for suspicious presigned URL usage
• Perform vulnerability scanning to identify exposed assets
• Review compensating controls for exposed systems while remediation is scheduled
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is limited; primary official records indicate a vulnerability in OpenStack Swift through 2.38.0, where S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. To verify, defenders should review the official CVE record and OpenStack security advisory for affected versions and configurations, focusing on default s3_acl=false configurations. Additional verification may involve checking for unusual presigned URL usage and monitoring for potential data exposure.

Official resources