CVE-2026-97149: openstack swift Incomplete List of Disallowed Inputs

Vulnerability summary

CVE-2026-97149 is a medium (CVSS 5.3) Incomplete List of Disallowed Inputs vulnerability in openstack swift. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.3% of scored vulnerabilities.

Timeline

1. 24-09-2026
   PublishedVulnerability first disclosed.
2. 06-10-2026
   Last modifiedVulnerability information updated.

Description

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected.

• CWE-184Incomplete List of Disallowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.