Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-23T17:03:32 openstack-swift: OpenStack Swift: SSRF via internal update header injection in proxy-server 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CWE-918

In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to redirect container update requests to an attacker-controlled server, enabling server-side request forgery. The SSRF requests expose internal cluster metadata including storage policy indexes, partition mappings, device names, and when at rest encryption is enabled, cipher text and initialization vectors for the container-level encryption key. The attacker can also cause "ghost listings" in arbitrary containers via the shard-range redirect mechanism.

A flaw was found in OpenStack Swift's proxy-server. Internal container update routing headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) are not stripped from client requests before being forwarded to object-servers. An authenticated user with write access can inject these headers to redirect internal container update requests to an attacker-controlled server, resulting in server-side request forgery. This can lead to disclosure of internal cluster metadata and, when at-rest encryption is enabled, exposure of encrypted container-level key material. Additionally, the attacker can create unauthorized listings in arbitrary containers via the shard-range redirect mechanism.

Red Hat OpenStack Platform 13, 16.2, 17.1, and Red Hat OpenStack Services on OpenShift 18.0 ship OpenStack Swift proxy-server in affected versions and are vulnerable to this flaw. This vulnerability is rated as Moderate severity because exploitation requires an authenticated user with write access to at least one Swift container. The SSRF allows redirection of container update requests to attacker-controlled servers, exposing internal cluster metadata. When at-rest encryption is enabled, cipher text and initialization vectors for the container-level encryption key are also exposed, though the encryption key itself is not directly disclosed. The attack is network-accessible but requires valid credentials and write permissions, limiting the attacker population to existing tenants within the deployment. There is no mitigation for this flaw. The only resolution is to upgrade OpenStack Swift to a patched version: 2.35.3 (for the 2.0.0+ series), 2.36.2 (for the 2.36.x series), or 2.37.2 (for the 2.37.x series). The risk is partially limited because exploitation requires an authenticated user with write access to at least one Swift container. Red Hat Developer Hub Fix deferred rhdh/rhdh-hub-rhel9 Red Hat OpenStack Platform 13 (Queens) Out of support scope rhosp13/openstack-swift-account Red Hat OpenStack Platform 13 (Queens) Out of support scope rhosp13/openstack-swift-base Red Hat OpenStack Platform 13 (Queens) Out of support scope rhosp13/openstack-swift-container Red Hat OpenStack Platform 13 (Queens) Out of support scope rhosp13/openstack-swift-object Red Hat OpenStack Platform 13 (Queens) Out of support scope rhosp13/openstack-swift-proxy-server Red Hat OpenStack Platform 16.2 Fix deferred openstack-swift Red Hat OpenStack Platform 16.2 Fix deferred rhosp-rhel8/openstack-swift-account Red Hat OpenStack Platform 16.2 Fix deferred rhosp-rhel8/openstack-swift-base Red Hat OpenStack Platform 16.2 Fix deferred rhosp-rhel8/openstack-swift-container Red Hat OpenStack Platform 16.2 Fix deferred rhosp-rhel8/openstack-swift-object Red Hat OpenStack Platform 16.2 Fix deferred rhosp-rhel8/openstack-swift-proxy-server Red Hat OpenStack Platform 17.1 Fix deferred openstack-swift Red Hat OpenStack Platform 17.1 Fix deferred rhosp-rhel9/openstack-swift-account Red Hat OpenStack Platform 17.1 Fix deferred rhosp-rhel9/openstack-swift-base Red Hat OpenStack Platform 17.1 Fix deferred rhosp-rhel9/openstack-swift-container Red Hat OpenStack Platform 17.1 Fix deferred rhosp-rhel9/openstack-swift-object Red Hat OpenStack Platform 17.1 Fix deferred rhosp-rhel9/openstack-swift-proxy-server Red Hat OpenStack Platform 18.0 Fix deferred openstack-swift Red Hat OpenStack Platform 18.0 Fix deferred rhoso/openstack-swift-account-rhel9 Red Hat OpenStack Platform 18.0 Fix deferred rhoso/openstack-swift-base-rhel9 Red Hat OpenStack Platform 18.0 Fix deferred rhoso/openstack-swift-container-rhel9 Red Hat OpenStack Platform 18.0 Fix deferred rhoso/openstack-swift-object-rhel9 Red Hat OpenStack Platform 18.0 Fix deferred rhoso/openstack-swift-proxy-server-rhel9 Self-service automation portal 2 Fix deferred ansible-automation-platform/automation-portal Self-service automation portal 2 Fix deferred ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-50221 https://nvd.nist.gov/vuln/detail/CVE-2026-50221 https://launchpad.net/bugs/2150261 https://security.openstack.org/ossa/OSSA-2026-024.html https://www.openwall.com/lists/oss-security/2026/06/23/5