Separate OpenStack Swift notices cover leak and denial of service
OpenStack and Ubuntu issued separate Swift notices on 24 September 2026 for a tempurl leak and an authenticated denial of service.
On 24 September 2026, OpenStack published OSSA-2026-041 for CVE-2026-97149, a cross-container information disclosure in Swift's tempurl feature reported by Oren Yomtov of ACT Security. The advisory says the issue affects Swift from version 1.4.6 and lists the 2.36.0 and 2.37.0 lines plus releases before 2.38.2. The same day, Ubuntu security notice USN-8821-1 warned that Swift's s3api middleware incorrectly handled truncated aws-chunked PUT request bodies, so an authenticated attacker could consume excessive resources and cause a denial of service. USN-8821-1 does not name a CVE. The notices describe different Swift flaws rather than conflicting accounts of one bug, and neither reports exploitation in the wild.
- OSSA-2026-041 covers CVE-2026-97149, a cross-container information disclosure in OpenStack Swift tempurl, reported by Oren Yomtov of ACT Security.
- CVE-2026-97149 affects Swift from version 1.4.6; listed lines include 2.36.0 and 2.37.0 and releases before 2.38.2.
- Ubuntu USN-8821-1, also dated 2026-09-24, describes a separate Swift bug in s3api handling of truncated aws-chunked PUT request bodies.
- USN-8821-1 says an authenticated attacker could exhaust resources and cause a denial of service, and it names no CVE.
- Neither the OpenStack notice nor the Ubuntu notice reports exploitation in the wild.
Coverage timelineoldest first · each row is one article
- · 2d ago[OSSA-2026-041] OpenStack Swift: Cross-container information disclosure via Swift tempurl (CVE-2026-97149)
oss-security· 51
OpenStack Swift tempurl bug CVE-2026-97149 can leak information across containers.
- · 2d agoUSN-8821-1: OpenStack Swift vulnerability
Ubuntu Security Notices· 24
Ubuntu warns an authenticated OpenStack Swift bug can cause a denial of service.
Vulnerabilities in this storyAll →
- CVE-2026-971495.3—In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requestspublished
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-97149 | In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected. |