Threats tagged 'ghsa-ppc2-wr9h-8mxg'

CVE-2026-97149 is a medium severity vulnerability in OpenStack Swift before version 2.38.2. The tempurl middleware does not reject the X-Copy-From header on PUT requests, allowing an attacker with a valid PUT TempURL to copy any object within the same account. This occurs because the TempURL signature does not cover the X-Copy-From header, and the disallowed headers list is incomplete. The vulnerability affects deployments using the default proxy pipeline with account-level TempURL keys. Cross-account copying is not possible, limiting the scope to the same account.