UNKNOWN OpenStack
CVE-2026-50221
OSSA-2026-024: Swift proxy-server SSRF via header injection
Tim Shephard from roiai.ca reported a server-side request forgery (SSRF) vulnerability in Swift’s proxy-server. An authenticated user can cause Swift object servers to issue outbound HTTP requests to attacker-specified hosts, potentially exposing internal infrastructure details. All deployments running Swift 2.0.0 or later are affected. Patches ¶ https://review.opendev.org/994452 (2025.1/epoxy) https://review.opendev.org/994451 (2025.2/flamingo) https://review.opendev.org/994450 (2026.1/gazpacho
Affected Products
- Swift: >=2.0.0 <2.35.3, >=2.36.0 <2.36.2, >=2.37.0 <2.37.2
- CVE-2026-50221
References
- https://security.openstack.org/ossa/OSSA-2026-024.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-50221
This unknown severity vulnerability was published on 2026-06-23 via OpenStack. Affected: Swift: >=2.0.0 <2.35.3, >=2.36.0 <2.36.2, >=2.37.0 <2.37.2, CVE-2026-50221.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.