CVE-2026-50221

In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to redirect container update requests to an attacker-controlled server, enabling server-side request forgery. The SSRF requests expose internal cluster metadata including storage policy indexes, partition mappings, device names, and when at rest encryption is enabled, cipher text and initialization vectors for the container-level encryption key. The attacker can also cause "ghost listings" in arbitrary containers via the shard-range redirect mechanism.

CVSS 4.0

5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

CVSS 3.1

5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-25)

CWE

CWE-918

Published

2026-06-23

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

Affected

• openstack:swift

Packages (OSV)

References

• https://launchpad.net/bugs/2150261
• https://security.openstack.org/ossa/OSSA-2026-024.html
• https://www.openwall.com/lists/oss-security/2026/06/23/5
• http://www.openwall.com/lists/oss-security/2026/06/23/5

Check your stackJSON