[OSSA-2026-030] OpenStack Swift: S3API header authorization bypass (CVE-2026-pending)

[Goutham Pacha Ravi <gouthampravi () gmail com>]

======================================================
OSSA-2026-030: Swift S3API header authorization bypass
======================================================

:Date: July 28, 2026
:CVE: CVE-2026-pending,
      CVE-2026-pending


Affects
~~~~~~~
- Swift: >=2.18.0 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0


Description
~~~~~~~~~~~
Christian Schwede from NVIDIA reported two authorization bypass 
vulnerabilities in Swift's S3API middleware. Insufficient validation of 
request headers allows an attacker to copy and read objects belonging to 
other tenants. The first issue affects the default ``s3_acl=false`` 
configuration; the second affects deployments with ``s3_acl=true``. Both 
require the attacker to know the target container and object names. All 
deployments using the S3API middleware with versions between 2.18.0 and 
the fixed releases listed below are affected.



Patches
~~~~~~~
- https://review.opendev.org/998948 (2025.1/epoxy)
- https://review.opendev.org/998949 (2025.1/epoxy)
- https://review.opendev.org/998946 (2025.2/flamingo)
- https://review.opendev.org/998947 (2025.2/flamingo)
- https://review.opendev.org/998944 (2026.1/gazpacho)
- https://review.opendev.org/998945 (2026.1/gazpacho)
- https://review.opendev.org/998942 (2026.2/hibiscus (development))
- https://review.opendev.org/998943 (2026.2/hibiscus (development))


Credits
~~~~~~~
- Christian Schwede from NVIDIA


References
~~~~~~~~~~
- https://launchpad.net/bugs/2158733
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending

--
Goutham Pacha Ravi
OpenStack Vulnerability Management Team
https://security.openstack.org/vmt.html

Attachment: OpenPGP_0x0638DAD3B82C3988.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature