CVE-2026-50221 is a server-side request forgery vulnerability in OpenStack Swift prior to version 2.37.2. The proxy-server fails to strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object-servers. An authenticated user with write permissions can exploit this to redirect container update requests to attacker-controlled servers, exposing sensitive internal metadata such as storage policy indexes, partition mappings, device names, and encrypted container keys (cipher text and initialization vectors). Additionally, the attacker can induce ghost listings in arbitrary containers via the shard-range redirect mechanism.

The vulnerability allows an authenticated user with write access to perform SSRF attacks that expose sensitive internal cluster metadata and encrypted container-level keys. This could lead to information disclosure about the storage infrastructure and potentially compromise container data confidentiality. The ability to cause ghost listings may also impact container integrity or visibility.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict write access to trusted users only and monitor for unusual container update requests that include internal update headers.