CVE-2026-97149

A flaw was found in OpenStack Swift's tempurl middleware. A TempURL is a signed, time-limited link that should allow access to only one object. The signature does not cover extra request headers, and Swift did not block the X-Copy-From header on these signed upload requests. An attacker who alrea...

[SECURITY] [DSA 6519-1] swift security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6519-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 26, 2026 https://www.debian.org/security/faq -...

Debian dsa-6519 : python3-swift - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6519 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6519-1 [email protected] https://www.debian.org/security/ Moritz...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

DEBIAN-CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

UBUNTU-CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

EUVD-2026-85786

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift versions before 2.38.2 , a vulnerability exists because the tempurl middleware fails to reject the X-Copy-From header on PUT requests. Since the TempURL signature only validates the method, expiry, and path, an attacker with a valid PUT TempURL for a single object can include a...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

PT-2026-97695

Name of the Vulnerable Software and Affected Versions OpenStack Swift versions prior to 2.38.2 Description The tempurl middleware fails to reject the X-Copy-From header during PUT requests. Because a TempURL signature only validates the method, expiry, and path, the system relies on a list of...

Linux Distros Unpatched Vulnerability : CVE-2026-97149

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method,...

CVE-2026-97149: Incomplete List of Disallowed Inputs

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

Temporary urls leaked via logging

In OpenStack Swift prior to 2.15.2, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected...

PYSEC-2026-751 Temporary urls leaked via logging

In OpenStack Swift prior to 2.15.2, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected...

EUVD-2021-1291

Malware in sbrugna...

EUVD-2022-4873

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2017-8761

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures ...

RHEL 6 : openstack-swift (RHSA-2014:0367)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0367 advisory. OpenStack Object Storage swift provides object storage in virtual containers, which allows users to store and retrieve files arbitrary data. The...