CVE-2026-71192: Incorrect Authorization

In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...

PT-2026-67963

Name of the Vulnerable Software and Affected Versions OpenStack Swift versions prior to 2.38.1 Description The S3API middleware fails to sanitize Swift-native control headers X-Copy-From and X-Copy-From-Account in S3 API requests when the s3 acl=true configuration is enabled. An attacker can inje...