OSSA-2026-030: Swift S3API header authorization bypass¶
- Date:
July 28, 2026
- CVE:
CVE-2026-pending, CVE-2026-pending
Affects¶
Swift: >=2.18.0 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0
Description¶
Christian Schwede from NVIDIA reported two authorization bypass vulnerabilities in Swift’s S3API middleware. Insufficient validation of request headers allows an attacker to copy and read objects belonging to other tenants. The first issue affects the default s3_acl=false configuration; the second affects deployments with s3_acl=true. Both require the attacker to know the target container and object names. All deployments using the S3API middleware with versions between 2.18.0 and the fixed releases listed below are affected.
Patches¶
https://review.opendev.org/998948 (2025.1/epoxy)
https://review.opendev.org/998949 (2025.1/epoxy)
https://review.opendev.org/998946 (2025.2/flamingo)
https://review.opendev.org/998947 (2025.2/flamingo)
https://review.opendev.org/998944 (2026.1/gazpacho)
https://review.opendev.org/998945 (2026.1/gazpacho)
https://review.opendev.org/998942 (2026.2/hibiscus (development))
https://review.opendev.org/998943 (2026.2/hibiscus (development))
Credits¶
Christian Schwede from NVIDIA
