CVE-2026-97149

Severity: medium (CVSS 5.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-24 · updated 2026-10-06
Weakness: CWE-184

Description

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected.

Affected products

OpenStack Swift: from 2.4.0 before 2.35.5; from 2.36.0 before 2.36.4; from 2.37.0 before 2.37.4; from 2.38.0 before 2.38.2 — fixed in 2.35.5, 2.36.4, 2.37.4, 2.38.2

How to fix

Upgrade to a fixed version: OpenStack Swift 2.35.5, 2.36.4, 2.37.4, 2.38.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-97149 or the next vulnerability affects your stack