CVE-2026-71192: CWE-863 Incorrect Authorization in OpenStack Swift
CVE-2026-71192 is a medium severity vulnerability in OpenStack Swift up to version 2.38.0. It involves incorrect authorization in the S3API middleware when the non-default configuration s3_acl=true is enabled. An attacker can inject Swift-native control headers into a signed PUT request to cause a server-side copy of another tenant's private object, bypassing source object authorization. This allows unauthorized reading of objects if the attacker knows the project ID, container name, and object name.
AI Analysis
Technical Summary
OpenStack Swift versions 2.18.0, 2.36.0, 2.37.0, and 2.38.0 are affected by a CWE-863 incorrect authorization vulnerability in the S3API middleware when s3_acl=true is configured. The middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) in S3 API requests, enabling an attacker to inject these headers into a signed PUT request targeting their own bucket. This causes Swift to perform a server-side copy from another tenant's private object without proper authorization checks on the source object, allowing unauthorized reading of that object. The vulnerability requires knowledge of the source object's project ID, container name, and object name. The CVSS 4.0 score is 6.0 (medium severity).
Potential Impact
An attacker with limited privileges can bypass source object authorization controls to read private objects belonging to other tenants by exploiting the S3API middleware's failure to sanitize control headers during server-side copy operations. This compromises confidentiality of objects in OpenStack Swift when s3_acl=true is enabled.
Mitigation Recommendations
A patch is available for this vulnerability. Since this is a cloud service, the vendor typically manages remediation server-side. Users should verify with the OpenStack vendor advisory for patch deployment status and apply updates accordingly. Until patched, disabling the non-default s3_acl=true configuration can mitigate the issue.
CVE-2026-71192: CWE-863 Incorrect Authorization in OpenStack Swift
Description
CVE-2026-71192 is a medium severity vulnerability in OpenStack Swift up to version 2.38.0. It involves incorrect authorization in the S3API middleware when the non-default configuration s3_acl=true is enabled. An attacker can inject Swift-native control headers into a signed PUT request to cause a server-side copy of another tenant's private object, bypassing source object authorization. This allows unauthorized reading of objects if the attacker knows the project ID, container name, and object name.
CVSS v4.0
Score 6.0medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenStack Swift versions 2.18.0, 2.36.0, 2.37.0, and 2.38.0 are affected by a CWE-863 incorrect authorization vulnerability in the S3API middleware when s3_acl=true is configured. The middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) in S3 API requests, enabling an attacker to inject these headers into a signed PUT request targeting their own bucket. This causes Swift to perform a server-side copy from another tenant's private object without proper authorization checks on the source object, allowing unauthorized reading of that object. The vulnerability requires knowledge of the source object's project ID, container name, and object name. The CVSS 4.0 score is 6.0 (medium severity).
Potential Impact
An attacker with limited privileges can bypass source object authorization controls to read private objects belonging to other tenants by exploiting the S3API middleware's failure to sanitize control headers during server-side copy operations. This compromises confidentiality of objects in OpenStack Swift when s3_acl=true is enabled.
Mitigation Recommendations
A patch is available for this vulnerability. Since this is a cloud service, the vendor typically manages remediation server-side. Users should verify with the OpenStack vendor advisory for patch deployment status and apply updates accordingly. Until patched, disabling the non-default s3_acl=true configuration can mitigate the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-08-05T05:05:32.904Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a72cd1fbf8831d5394f40ec
Added to database: 08/05/2026, 05:41:51 UTC
Last enriched: 08/05/2026, 05:57:19 UTC
Last updated: 08/05/2026, 09:50:36 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.