CVE-2026-94368 Overview
CVE-2026-94368 is a signature verification flaw in noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The service mishandles S3 presigned URLs signed with Signature Version 4 (SigV4). Instead of rejecting requests that include unsigned x-amz- headers, noobaa-core silently drops those headers from the signature calculation and processes the request. An attacker holding a valid presigned PUT URL can inject an unsigned x-amz-copy-source header, converting a benign upload into a CopyObject operation. The result is unauthorized read access to any object the original signer can reach across the storage system.
Critical Impact
A single valid presigned PUT URL can be transformed into an arbitrary CopyObject request, exposing every object the signer is authorized to read across the multicloud gateway.
Affected Products
- NooBaa Multicloud Object Gateway (noobaa-core)
- Red Hat OpenShift Data Foundation deployments bundling NooBaa
- Downstream distributions embedding vulnerable noobaa-core builds
Discovery Timeline
- 2026-09-21 - CVE-2026-94368 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-94368
Vulnerability Analysis
The defect sits in the SigV4 verification path of noobaa-core. AWS SigV4 requires every x-amz-* header present on a request to be included in the SignedHeaders list and the canonical request used to compute the signature. When noobaa-core encounters an x-amz-* header that is not covered by SignedHeaders, the correct behavior is to reject the request. Instead, the service strips the header from the canonical request and validates the signature against the remaining fields.
Because verification still succeeds, an attacker can append semantically meaningful headers to any presigned URL they possess. The x-amz-copy-source header is particularly impactful: on a PUT request it instructs the S3 API to perform a server-side copy from an arbitrary source object into the destination targeted by the presigned URL. The signer's credentials authorize the copy, so the attacker obtains data they were never granted access to.
The weakness maps to CWE-347: Improper Verification of Cryptographic Signature.
Root Cause
The canonical request builder trusts the client-supplied SignedHeaders list and discards unsigned x-amz-* headers rather than treating their presence as a protocol violation. AWS SigV4 specification requires the opposite: unsigned x-amz-* headers must invalidate the request.
Attack Vector
An attacker requires a valid SigV4 presigned PUT URL, which is often shared with lower-trust parties for upload workflows. The attacker issues the PUT request to the NooBaa endpoint and adds an x-amz-copy-source header pointing at any bucket and key the signer can read. NooBaa validates the truncated signature, then executes the copy using the signer's permissions. No credentials, cracking, or additional authentication are required beyond possession of the presigned URL.
The vulnerability is described in prose only; see the Red Hat CVE-2026-94368 Advisory and Red Hat Bug Report #2537364 for vendor technical detail.
Detection Methods for CVE-2026-94368
Indicators of Compromise
- PUT requests to NooBaa S3 endpoints that carry an x-amz-copy-source header while the SignedHeaders value in the Authorization header does not list x-amz-copy-source.
- CopyObject operations recorded in NooBaa audit logs that originate from presigned URL sessions rather than direct authenticated API calls.
- Object read patterns where a single signer identity appears to read across buckets or prefixes that its normal workload does not touch.
Detection Strategies
- Parse S3 access logs and flag any request whose header set contains x-amz-* headers absent from the SignedHeaders component of the SigV4 Authorization header.
- Alert on presigned URL sessions that produce CopyObject semantics, since presigned PUT URLs are typically intended for direct uploads only.
- Correlate outbound object copies with the identity of the presigned URL signer to detect scope expansion beyond the intended upload target.
Monitoring Recommendations
- Enable full NooBaa S3 API audit logging and forward events to a centralized analytics platform for retention and query.
- Baseline expected presigned URL usage per application and alert on deviations in header composition or request verbs.
- Monitor egress volume from NooBaa buckets for anomalous spikes that could indicate bulk cross-bucket copying.
How to Mitigate CVE-2026-94368
Immediate Actions Required
- Upgrade noobaa-core to a fixed release as listed in the Red Hat CVE-2026-94368 Advisory.
- Rotate or invalidate any long-lived presigned URLs currently issued against affected NooBaa endpoints.
- Audit recent CopyObject activity for signs of unauthorized cross-bucket reads while presigned URLs remained valid.
Patch Information
Refer to the Red Hat CVE-2026-94368 Advisory and Red Hat Bug Report #2537364 for fixed package versions across supported channels. Apply the vendor-supplied update to the NooBaa Multicloud Object Gateway and restart the affected pods or services.
Workarounds
- Reduce the maximum lifetime of presigned URLs to the shortest value that still supports the workflow, limiting the exposure window.
- Front NooBaa endpoints with a reverse proxy or WAF rule that rejects requests containing x-amz-* headers not enumerated in the SigV4 SignedHeaders field.
- Constrain signer IAM policies so that PUT-only workflows cannot authorize reads on sensitive buckets, limiting blast radius if a presigned URL is abused.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.