CVE-2026-50221

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-23 · updated 2026-10-25
Weakness: CWE-918

Description

In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to redirect container update requests to an attacker-controlled server, enabling server-side request forgery. The SSRF requests expose internal cluster metadata including storage policy indexes, partition mappings, device names, and when at rest encryption is enabled, cipher text and initialization vectors for the container-level encryption key. The attacker can also cause "ghost listings" in arbitrary containers via the shard-range redirect mechanism.

Affected products

OpenStack Swift: from 2.0.0 before 2.35.3; from 2.36.0 before 2.36.2; from 2.37.0 before 2.37.2 — fixed in 2.35.3, 2.36.2, 2.37.2

How to fix

Upgrade to a fixed version: OpenStack Swift 2.35.3, 2.36.2, 2.37.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-50221 or the next vulnerability affects your stack