{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97149", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-09-24T02:25:48.652Z", "datePublished": "2026-09-24T02:25:49.093Z", "dateUpdated": "2026-10-06T17:42:19.236Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Swift", "repo": "https://opendev.org/openstack/swift", "vendor": "OpenStack", "versions": [{"lessThan": "2.35.5", "status": "affected", "version": "2.4.0", "versionType": "semver"}, {"lessThan": "2.36.4", "status": "affected", "version": "2.36.0", "versionType": "semver"}, {"lessThan": "2.37.4", "status": "affected", "version": "2.37.0", "versionType": "semver"}, {"lessThan": "2.38.2", "status": "affected", "version": "2.38.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-184", "description": "CWE-184 Incomplete List of Disallowed Inputs", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-24T02:25:49.093Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://launchpad.net/bugs/2166876"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.4.0", "versionEndExcluding": "2.35.5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.36.0", "versionEndExcluding": "2.36.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.37.0", "versionEndExcluding": "2.37.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.38.0", "versionEndExcluding": "2.38.2"}]}]}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/24/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-24T18:09:33.737Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T15:53:29.868605Z", "id": "CVE-2026-97149", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T17:42:19.236Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Swift", "repo": "https://opendev.org/openstack/swift", "vendor": "OpenStack", "versions": [{"lessThan": "2.35.5", "status": "affected", "version": "2.4.0", "versionType": "semver"}, {"lessThan": "2.36.4", "status": "affected", "version": "2.36.0", "versionType": "semver"}, {"lessThan": "2.37.4", "status": "affected", "version": "2.37.0", "versionType": "semver"}, {"lessThan": "2.38.2", "status": "affected", "version": "2.38.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected."}], "id": "CVE-2026-97149", "lastModified": "2026-10-06T18:16:59.117", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-97149", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T15:53:29.868605Z", "version": "2.0.3"}}]}, "published": "2026-09-24T03:16:59.133", "references": [{"source": "cve@mitre.org", "url": "https://launchpad.net/bugs/2166876"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/09/24/5"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-184"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "openstack-swift: openstack-swift: unauthorized read of other objects via TempURL and X-Copy-From", "id": "2539886", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539886"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-358", "details": ["A flaw was found in OpenStack Swift's tempurl middleware. A TempURL is a signed, time-limited link that should allow access to only one object. The signature does not cover extra request headers, and Swift did not block the X-Copy-From header on these signed upload requests. An attacker who already holds a valid upload TempURL for one object can name another object in the same account. Swift copies that object's contents into the allowed destination, and the attacker can then download it. This exposes data the TempURL was not meant to grant. The attacker must know the other object's container and name, and the copy cannot cross into a different account. Only deployments that use the tempurl middleware are affected."], "mitigation": {"lang": "en:us", "value": "Until a product update is available, operators can drop the dangerous header in the proxy configuration. In the [filter:tempurl] section, add x-copy-from to the incoming_remove_headers option. Swift then removes the header, and the signed upload does not copy another object. This applies only where the tempurl middleware is enabled. If TempURL is not required, leaving that middleware out of the proxy pipeline also avoids the issue."}, "name": "CVE-2026-97149", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "package_name": "openstack-swift", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "openstack-swift", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "openstack-swift", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "openstack-swift", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-09-24T02:25:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97149\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97149\nhttps://launchpad.net/bugs/2166876\nhttps://security.openstack.org/ossa/OSSA-2026-041.html"], "statement": "This vulnerability is rated Moderate because a party who already holds a valid upload TempURL can read other objects in the same Swift account. The attack does not cross into another account, does not allow code execution, and requires the attacker to know the target container and object name. The tempurl middleware must be enabled. That middleware is part of the default Swift proxy pipeline.\nThe following Red Hat products ship openstack-swift builds that contain the vulnerable code and are affected: Red Hat OpenStack Platform 13 (openstack-swift 2.17.1), Red Hat OpenStack Platform 16.2 (openstack-swift 2.23.4), Red Hat OpenStack Platform 17.1 (openstack-swift 2.27.1), and Red Hat OpenStack Services on OpenShift 18 (openstack-swift 2.31.2).\nAnsible Automation Platform and Red Hat Developer Hub are not affected. Name matches in those products are a JavaScript client library for Swift, not the Swift service.", "threat_severity": "Moderate"}