CVE-2026-97149: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-97149 is a header injection vulnerability in OpenStack Swift's tempurl middleware that allows an attacker holding a valid PUT TempURL to read arbitrary objects within the same account by injecting an X-Copy-From header. The vulnerability affects OpenStack Swift versions 2.4.0 through 2.35.4, 2.36.0 through 2.36.3, 2.37.0 through 2.37.3, and 2.38.0 through 2.38.1. It was disclosed on September 24, 2026, with a patch available in versions 2.35.5, 2.36.4, 2.37.4, and 2.38.2. The CVSS v4.0 base score is 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-184 (Incomplete List of Disallowed Inputs): the tempurl middleware relies solely on a blocklist of disallowed HTTP headers to constrain what a signed PUT request can do, but fails to include X-Copy-From in that list. Because a TempURL signature only covers the HTTP method, expiry time, and object path — not request headers — an attacker can append X-Copy-From: /v1/<account>/<container>/<victim-object> to a legitimate PUT TempURL request. The copy middleware then copies the named victim object to the attacker's destination path, after which the attacker retrieves the data using a GET TempURL for that destination. Cross-account copies are rejected, limiting the scope to objects within the same account. Only deployments using the default proxy pipeline with both tempurl and copy middleware enabled, and using account-level TempURL keys, are affected (GitHub Advisory, Feedly).

Successful exploitation results in unauthorized disclosure of arbitrary objects stored within the same OpenStack Swift account as the attacker's TempURL. An attacker with a single valid PUT TempURL — which may be legitimately issued for a low-sensitivity object — can pivot to read any other object in the account, including potentially sensitive data such as application files, backups, or credentials stored in object storage. There is no integrity or availability impact; the attack is purely a confidentiality breach limited to the account boundary (GitHub Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already possess a valid PUT TempURL for at least one object in the target account, which limits the attack surface to scenarios where TempURLs are shared or leaked.

1. Obtain a PUT TempURL: Acquire a valid PUT TempURL for any object within the target OpenStack Swift account (e.g., through a legitimately issued URL, a leaked URL, or a low-privilege account).
2. Identify target object: Determine the path of a victim object within the same account that the attacker wishes to read (e.g., /v1/<account>/<container>/<victim-object>).
3. Craft the malicious PUT request: Issue a PUT request to the attacker's TempURL destination, appending the X-Copy-From header pointing to the victim object:

   PUT /v1/<account>/<attacker-container>/<dest-object>?temp_url_sig=<sig>&temp_url_expires=<expiry>
   X-Copy-From: /<container>/<victim-object>

4. Trigger server-side copy: The copy middleware processes the X-Copy-From header and copies the victim object's content to the attacker's destination path, bypassing the TempURL signature scope.
5. Retrieve victim data: Use a GET TempURL for the destination object (if available) or any other read access to the destination to retrieve the copied victim data (GitHub Advisory, Feedly).

• Network: PUT requests to Swift TempURL endpoints that include an X-Copy-From header; these should not normally appear in TempURL-based workflows.
• Logs: Swift proxy access logs showing PUT requests with X-Copy-From headers originating from TempURL-signed requests (identifiable by temp_url_sig and temp_url_expires query parameters); subsequent GET requests to the same destination object shortly after an unexpected PUT.
• File System / Object Storage: Unexpected objects appearing in attacker-controlled containers whose content matches sensitive objects from other containers in the same account; object metadata showing a copy operation (X-Copied-From response header in Swift logs).

Upgrade OpenStack Swift to one of the patched versions: 2.35.5, 2.36.4, 2.37.4, or 2.38.2, which add X-Copy-From to the tempurl middleware's list of disallowed headers. If immediate patching is not possible, consider disabling the copy middleware in the proxy pipeline if it is not operationally required, or restrict the issuance of account-level TempURL keys. Audit existing TempURL usage to identify any potentially exposed or over-privileged signed URLs and revoke them if necessary (GitHub Advisory, Feedly).