In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4801 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4801-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/          Carlos Henrique Lima Melara     September 29, 2026                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : swift     Version        : 2.30.1-0+deb12u3     CVE ID         : CVE-2026-71191 CVE-2026-97149     Debian Bug     : 1142972 1148834

    Two vulnerabilities were discovered in Swift, OpenStack's object     storage service, that could lead to information disclosure.

    CVE-2026-71191 / OSSA-2026-030

    An authorization bypass in the S3API middleware: client-supplied     native Swift control headers (X-Copy-From(-Account),     X-Symlink-Target(-Account), X-Object-Manifest, X-Static-Large-Object)     were not stripped from client requests, allowing a user to bypass S3     ACL checks; sensitive SigV4 x-amz headers were also not required to     be signed.

    CVE-2026-97149 / OSSA-2026-041

    A user holding a PUT tempurl for an object could add an X-Copy-From     header to the request to copy any other object within the account,     resulting in cross-container information disclosure. Such requests     now get a 400 response.

    For Debian 12 bookworm, these problems have been fixed in version     2.30.1-0+deb12u3.

    We recommend that you upgrade your swift packages.

    For the detailed security status of swift please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/swift

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6449 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6449-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     August 18, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : swift     CVE ID         : CVE-2026-50221 CVE-2026-71191 CVE-2026-71192

    Multiple security vulnerabilities were discovered in Swift, a     distributed virtual object store, which could result in information     disclosure via SSRF or authorisation bypass in the s3api middleware.

    For the stable distribution (trixie), these problems have been fixed in     version 2.35.1-0+deb13u3.

    We recommend that you upgrade your swift packages.

    For the detailed security status of swift please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/swift

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are     covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can     inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary     source object using the signer's authorization context. The attacker can read any object the signer has     access to, provided the target project_id, container name, and object name are known. This affects all     deployments using the default s3_acl=false configuration. (CVE-2026-71191)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350990	Debian dla-4801 : python3-swift - security update	Nessus	Debian Local Security Checks	Local	medium
337867	Debian dsa-6449 : python3-swift - security update	Nessus	Debian Local Security Checks	Local	medium
332712	Linux Distros Unpatched Vulnerability : CVE-2026-71191	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-71191

medium

Tenable Plugins

medium

medium

medium