UNKNOWN OpenStack
CVE-2026-71191
OSSA-2026-030: Swift S3API header authorization bypass
Christian Schwede from NVIDIA reported two authorization bypass vulnerabilities in Swift’s S3API middleware. Insufficient validation of request headers allows an attacker to copy and read objects belonging to other tenants. The first issue affects the default s3_acl=false configuration; the second affects deployments with s3_acl=true . Both require the attacker to know the target container and object names. All deployments using the S3API middleware with versions between 2.18.0 and the fixed rel
Affected Products
- Swift: >=2.18.0 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0
- CVE-2026-71191
- CVE-2026-71192
References
- https://security.openstack.org/ossa/OSSA-2026-030.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-71191
- https://nvd.nist.gov/vuln/detail/CVE-2026-71192
This unknown severity vulnerability was published on 2026-07-28 via OpenStack. Affected: Swift: >=2.18.0 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0, CVE-2026-71191, CVE-2026-71192.
vulnfeed aggregates 14156 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.