CVE-2026-97149: OpenStack Swift Authentication Bypass Vulnerability

CVE-2026-97149 Overview

CVE-2026-97149 is an improper restriction of input vulnerability in OpenStack Swift before version 2.38.2. The tempurl middleware fails to reject the X-Copy-From header on signed PUT requests. A TempURL signature only covers the HTTP method, expiry, and path, so the disallowed-header list is the sole barrier preventing a signed PUT from performing unintended actions. An attacker holding a PUT TempURL for a single object can inject X-Copy-From to copy any object within the same account, then retrieve the data using a GET TempURL. Cross-account copies are rejected. The flaw is tracked as CWE-184: Incomplete List of Disallowed Inputs.

Critical Impact

Attackers with a single PUT TempURL can exfiltrate arbitrary objects from the same OpenStack Swift account by abusing the X-Copy-From header.

Affected Products

• OpenStack Swift versions prior to 2.38.2
• Deployments using the shipped default proxy pipeline with tempurl and copy middleware
• Deployments using account-level TempURL keys

Discovery Timeline

• 2026-09-24 - CVE CVE-2026-97149 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-97149

Vulnerability Analysis

OpenStack Swift's TempURL feature allows a user to pre-sign a URL granting temporary access to an object. The signature is computed over the HTTP method, expiry timestamp, and object path. It does not cover request headers. To prevent header-based abuse, the tempurl middleware maintains a list of disallowed inbound headers that it strips from requests before processing.

The disallowed list omits X-Copy-From. When the default proxy pipeline includes both tempurl and copy middleware, a PUT request bearing X-Copy-From: <account>/<container>/<object> instructs the copy middleware to treat the referenced object as the request body. The destination object receives a byte-for-byte copy of the source.

An attacker who holds a PUT TempURL for one destination object can therefore stage arbitrary same-account objects into that destination and read them back using a GET TempURL. The impact is confined to confidentiality within a single account; integrity and availability are not affected, and cross-account copies are blocked by existing checks.

Root Cause

The root cause is an incomplete deny list in the tempurl middleware. The middleware trusts the signature to constrain the request's effect, but the signature does not bind headers. Because X-Copy-From is not stripped, the copy middleware honors it and performs a server-side copy that the TempURL signer never authorized.

Attack Vector

Exploitation requires an attacker to possess a valid PUT TempURL and a GET TempURL for the same destination object, both of which may be legitimately issued for mundane uploads. The attacker sends a PUT request to the signed URL with an added X-Copy-From header naming any object in the same Swift account. The copy middleware writes the referenced object's contents to the destination. The attacker then issues the GET TempURL to retrieve the data. No authentication beyond the TempURLs is required, and no user interaction is involved.

See the Launchpad Bug Report and the OpenWall OSS-Security Post for upstream technical details.

Detection Methods for CVE-2026-97149

Indicators of Compromise

• Proxy access logs showing PUT requests with the temp_url_sig query parameter together with an X-Copy-From request header.
• Swift copy middleware log entries recording server-side copies whose source container differs from the destination container of a TempURL PUT.
• Rapid GET-after-PUT sequences against the same TempURL destination object originating from the same client IP.

Detection Strategies

• Parse Swift proxy logs for the co-occurrence of temp_url_sig and X-Copy-From on PUT requests; this combination has no legitimate use.
• Alert on TempURL PUT requests whose stored object size materially differs from the Content-Length of the signed request body.
• Correlate TempURL activity across containers belonging to the same account to detect anomalous cross-container copy patterns.

Monitoring Recommendations

• Enable verbose logging in the tempurl and copy middleware and forward proxy logs to a centralized analytics platform.
• Baseline per-account TempURL usage and alert on sudden increases in PUT volume or on PUTs targeting objects previously accessed only by privileged users.
• Review audit trails for TempURL key rotations and for keys with unusually broad scope at the account level.

How to Mitigate CVE-2026-97149

Immediate Actions Required

• Upgrade OpenStack Swift to version 2.38.2 or later, which rejects X-Copy-From on TempURL PUT requests.
• Rotate account-level TempURL keys after patching, since previously issued PUT TempURLs may have been abused.
• Audit proxy access logs for the IoCs listed above to determine whether exploitation has occurred.

Patch Information

The fix is included in OpenStack Swift 2.38.2. Operators running packaged distributions should install the vendor-supplied update that references CVE-2026-97149 or the Launchpad Bug Report. Verify the proxy service restarts cleanly after upgrade and that the tempurl middleware disallowed-headers list now includes X-Copy-From.

Workarounds

• If an immediate upgrade is not possible, remove the copy middleware from the proxy pipeline until Swift can be patched.
• Alternatively, deploy a reverse proxy or WSGI filter in front of Swift that strips X-Copy-From from any request containing a temp_url_sig query parameter.
• Prefer container-level TempURL keys with narrow scope over account-level keys to reduce the blast radius of any future TempURL middleware flaw.

# Example upstream filter: strip X-Copy-From from TempURL PUT requests in nginx
location / {
    if ($arg_temp_url_sig) {
        proxy_set_header X-Copy-From "";
        proxy_set_header X-Copy-From-Account "";
    }
    proxy_pass http://swift_proxy;
}