CVE-2026-97149

NameCVE-2026-97149
DescriptionIn OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1148834

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
swift (PTS)bookworm2.30.1-0+deb12u1vulnerable
bookworm (security)2.30.1-0+deb12u2vulnerable
trixie (security), trixie2.35.1-0+deb13u3vulnerable
forky2.37.1-6vulnerable
sid2.38.1-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
swiftsource(unstable)2.38.1-31148834

Notes

https://launchpad.net/bugs/2166876
https://security.openstack.org/ossa/OSSA-2026-041.html

Search for package or bug name: Reporting problems