OpenStack Swift versions up to 2.38.0 contain an authorization bypass vulnerability (CWE-863) in the S3API middleware. The middleware fails to require that semantic x-amz-* headers, specifically the X-Amz-Copy-Source header, are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy operation from an arbitrary source object using the signer's authorization context. This allows the attacker to read any object the signer has access to, provided the attacker knows the project_id, container name, and object name. The vulnerability affects all deployments using the default s3_acl=false configuration. The CVSS 4.0 base score is 6.0 (medium severity). The vulnerability is present in versions =2.18.0, =2.36.0, =2.37.0, and =2.38.0. The vendor manages remediation for this cloud-hosted service, and a patch is available.

An attacker who obtains a presigned PUT URL can bypass authorization controls by injecting an unsigned X-Amz-Copy-Source header, causing the server to copy data from arbitrary source objects accessible to the signer. This results in unauthorized read access to objects within the signer's authorization scope. The impact is limited to information disclosure of objects the signer can access and requires knowledge of the target project_id, container, and object names.

A patch is available for this vulnerability. Since OpenStack Swift is offered as a cloud service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory that their deployment has been updated to a version that enforces signature coverage of x-amz-* headers on presigned URL requests. If self-hosted, upgrade to a fixed version beyond 2.38.0 once available. No additional mitigations are specified.