OpenStack Swift: S3API does not strip X-Copy-From, allowing cross-tenant object reads

Impact

With the non-default s3_acl=true setting, the S3API middleware passes Swift-native X-Copy-From and X-Copy-From-Account headers through from a signed S3 request. Because the middleware has already authorized the request against the attacker's own destination bucket, Swift performs the server-side copy without checking the source object's ACLs or ownership. Any object whose project_id, container and object name are known can be copied into the attacker's bucket and read. For a GPU cloud using Swift as the shared object store for datasets, checkpoints and model artefacts, that is a direct cross-tenant read of training data and weights, with no write or delete effect on the victim.

Who can reach it

Any authenticated tenant with an S3 credential and a bucket of their own, over the object storage endpoint. Requires knowledge of the target's project id, container name and object name, and only affects deployments configured with s3_acl=true.

What to do

Apply the Swift fix from OSSA-2026-030 to the proxy nodes and restart swift-proxy-server; proxies are stateless, so roll them behind the load balancer without touching storage nodes. If patching has to wait, set s3_acl=false (the default) in the S3API middleware config and restart the proxies - the vulnerable path does not exist without it, at the cost of S3-style ACL support. Affects Swift through 2.38.0.

References

Related entries

• Grafana: OAuth and OIDC access, refresh and ID tokens written unredacted to server logsCVE-2026-79656 · Grafana (OAuth/OIDC login - unredacted tokens written to server logs)Medium
• AMD NBIO register lock bits - MMIO routing configuration: The sibling of the SMN issue: unprotected NBIO lock bits letCVE-2025-61971 · AMD NBIO register lock bits - MMIO routing configurationMedium
• Jenkins Eggplant Runner Plugin: clears a JVM-wide proxy protection, exposing Basic credentials over HTTPS tunnelsCVE-2025-64135 · Jenkins Eggplant Runner Plugin (jdk.http.auth.tunneling.disabledSchemes)Medium
• ansible-runner: streamed archive extraction follows symlinks and writes outside the target directoryCVE-2026-103754 · ansible-runner (unstream_dir() in the transmit/worker protocol)Medium
• nfs-utils rpc.statd: memory leak on state notification requests lets a remote attacker exhaust node memoryCVE-2026-89096 · nfs-utils rpc.statd (NSM state notification callback handling)Medium
• GitLab: improper redirect validation in the Kubernetes proxy sends cluster auth tokens to an attacker-chosen serverCVE-2026-7767 · GitLab CE/EE (Kubernetes agent proxy redirect validation)Medium