[OSSA-2026-041] OpenStack Swift: Cross-container information disclosure via Swift tempurl (CVE-2026-97149)
OpenStack Swift tempurl bug CVE-2026-97149 can leak information across containers.
OpenStack published OSSA-2026-041 for CVE-2026-97149, a cross-container information disclosure in Swift's tempurl feature. The issue, reported by Oren Yomtov of ACT Security, affects Swift from version 1.4.6, and the advisory lists the 2.36.0 and 2.37.0 lines and releases before 2.38.2. The posted notice does not say the flaw is being exploited.
- OSSA-2026-041 covers Swift tempurl cross-container disclosure
- Tracked as CVE-2026-97149 and reported by Oren Yomtov of ACT Security
- Affects Swift from 1.4.6; listed branches include releases before 2.38.2
- The notice does not report in-the-wild exploitation
- CVEs
- CVE-2026-97149
- Vendors
- OpenStack
- Products
- OpenStack Swift
- Organizations
- OpenStackACT Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97149 | In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests | 5.3 | — |
From the original article
Posted by Goutham Pacha Ravi on Sep 24 ======================================================================= OSSA-2026-041: Cross-container information disclosure via Swift tempurl ======================================================================= :Date: September 24, 2026 :CVE: CVE-2026-97149 Affects ~~~~~~~ - Swift: >=1. 4. 6 =2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.