CVE-2026-71191 OpenStack CVE debrief

Who should care

Defenders responsible for OpenStack Swift deployments, especially those using the default s3_acl=false configuration, should assess their exposure to this vulnerability and prioritize updates to mitigate potential data access risks.

Why it matters

CVE-2026-71191 is a vulnerability in OpenStack Swift's S3API middleware that could allow unauthorized data access. Defenders should verify and update their deployments to prevent potential exploitation.

• Potential unauthorized data access through presigned URLs
• Risk of server-side copy operations being exploited for data theft
• Need for verification of OpenStack Swift configurations and updates
• Possible impact on data confidentiality due to improper access controls

Technical summary

The vulnerability in OpenStack Swift's S3API middleware allows an attacker to inject an unsigned X-Amz-Copy-Source header into presigned PUT URL requests. This enables server-side copies from arbitrary source objects using the signer's authorization context, potentially allowing unauthorized access to sensitive data. The issue affects all deployments using the default s3_acl=false configuration. Defenders should prioritize verifying and updating OpenStack Swift deployments to ensure that S3API middleware properly enforces SigV4 signature coverage for semantic x-amz-* headers on presigned URL requests.

Defensive priority

Defenders should prioritize verifying and updating OpenStack Swift deployments to ensure that S3API middleware properly enforces SigV4 signature coverage for semantic x-amz-* headers on presigned URL requests.

Recommended defensive actions

• Verify OpenStack Swift deployments for the default s3_acl=false configuration and assess exposure to presigned URL requests.
• Update OpenStack Swift to enforce SigV4 signature coverage for semantic x-amz-* headers on presigned URL requests.
• Monitor for and restrict unauthorized presigned URL usage, especially those allowing server-side copies from arbitrary source objects.
• Review and adjust access controls for project_id, container name, and object name to limit potential data exposure.
• Perform a thorough review of OpenStack Swift configurations and update documentation to reflect current deployment status.
• Conduct a compensating controls assessment to identify potential mitigations for exposed systems.
• Track exceptions and retest remediated assets to ensure vulnerability resolution.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in OpenStack Swift, including its impact and affected configurations. Defenders should verify OpenStack Swift deployments and configurations to assess exposure. Evidence is limited to public sources and may not be comprehensive. Further verification tasks are recommended to ensure accurate understanding of the vulnerability's impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.