CVE-2026-71192: CWE-863 Incorrect Authorization in OpenStack Swift
CVE-2026-71192 is a medium severity vulnerability in OpenStack Swift through version 2.38.0. It involves improper authorization in the S3API middleware when the non-default configuration s3_acl=true is enabled. An attacker can inject Swift-native control headers in signed PUT requests to perform unauthorized server-side copies of private objects from other tenants. This bypasses source object authorization, allowing the attacker to read any object if they know its project ID, container name, and object name.
AI Analysis
Technical Summary
OpenStack Swift versions up to 2.38.0 with s3_acl=true enabled in the S3API middleware do not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) in S3 API requests. This allows an attacker to inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The authorization check is only performed against the destination bucket, bypassing source object ACLs and ownership. This results in unauthorized read access to objects across tenants.
Potential Impact
An attacker with the ability to send signed PUT requests to their own bucket can read any object in Swift whose project ID, container name, and object name are known, regardless of the source object's ACLs or ownership. This leads to unauthorized data disclosure across tenants in a multi-tenant environment.
Mitigation Recommendations
The vendor manages remediation for this cloud-hosted service. A patch is available for affected versions. Users should ensure they upgrade to a fixed version or apply the vendor's official fix. Since this vulnerability requires the non-default s3_acl=true configuration, disabling this setting can also mitigate the risk if patching is not immediately possible.
CVE-2026-71192: CWE-863 Incorrect Authorization in OpenStack Swift
Description
CVE-2026-71192 is a medium severity vulnerability in OpenStack Swift through version 2.38.0. It involves improper authorization in the S3API middleware when the non-default configuration s3_acl=true is enabled. An attacker can inject Swift-native control headers in signed PUT requests to perform unauthorized server-side copies of private objects from other tenants. This bypasses source object authorization, allowing the attacker to read any object if they know its project ID, container name, and object name.
CVSS v4.0
Score 6.0medium
Affected software
OpenStack
Swift
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenStack Swift versions up to 2.38.0 with s3_acl=true enabled in the S3API middleware do not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) in S3 API requests. This allows an attacker to inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The authorization check is only performed against the destination bucket, bypassing source object ACLs and ownership. This results in unauthorized read access to objects across tenants.
Potential Impact
An attacker with the ability to send signed PUT requests to their own bucket can read any object in Swift whose project ID, container name, and object name are known, regardless of the source object's ACLs or ownership. This leads to unauthorized data disclosure across tenants in a multi-tenant environment.
Mitigation Recommendations
The vendor manages remediation for this cloud-hosted service. A patch is available for affected versions. Users should ensure they upgrade to a fixed version or apply the vendor's official fix. Since this vulnerability requires the non-default s3_acl=true configuration, disabling this setting can also mitigate the risk if patching is not immediately possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-08-05T05:05:32.904Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6a72cd1fbf8831d5394f40ec
Added to database: 08/05/2026, 05:41:51 UTC
Last enriched: 08/12/2026, 15:56:48 UTC
Last updated: 09/18/2026, 02:28:31 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.