OSSA-2026-041: Cross-container information disclosure via Swift tempurl

Date:

September 24, 2026

CVE:

CVE-2026-97149

Affects

  • Swift: >=1.4.6 <2.35.5, >=2.36.0 <2.36.4, >=2.37.0 <2.37.4, >=2.38.0 <2.38.2

Description

Oren Yomtov from ACT Security and “swdb”, a security researcher, independently reported a vulnerability in the Swift tempurl middleware. A party holding a single-object PUT TempURL signed with an account-level key (X-Account-Meta-Temp-URL-Key) could resend the signed request with an X-Copy-From header naming any object in the same account, causing Swift to copy the named object into the granted destination object, and read the copied bytes back with a second GET TempURL, disclosing objects the holder of the TempURL was not authorized to access. Only deployments with the tempurl middleware enabled are affected. The copy is limited to the account that owns the key, and the attacker must know the target container and object name.

As a mitigation, operators can add x-copy-from to the incoming_remove_headers option of the [filter:tempurl] section of their proxy server configuration. With that configuration the header is silently removed and the PUT stores no data; the patches below instead reject the request with a 400 response.

Patches

Credits

  • Oren Yomtov from ACT Security

  • swdb from Independent

References

Notes

  • This issue is distinct from the S3API vulnerabilities in OSSA-2026-030; it affects the native Swift API with the default proxy pipeline and does not require the S3API middleware or the s3_acl configuration.