---
cve: "CVE-2026-97149"
severity: "MEDIUM"
cvss: 5.3
epss: "0.2%"
vendor: "OpenStack"
kev: false
exploited: false
published: "2026-09-24 03:16:59"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-10-26T07:03:03+01:00"
---

# CVE-2026-97149

> 5.3 MEDIUM

## Beschreibung

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected.

## CNA-Record (Kanon, cvelistV5)

- CNA: **mitre**
- State: PUBLISHED
- Stand: 2026-10-06 17:42:19
- CNA-CVSS: **5.3** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-184** — Incomplete List of Disallowed Inputs
  The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

## Angriffsmuster (CAPEC)

- [CAPEC-3 — Using Leading 'Ghost' Character Sequences to Bypass Input Filters](https://capec.mitre.org/data/definitions/3.html) _(Severity: Medium)_
- [CAPEC-6 — Argument Injection](https://capec.mitre.org/data/definitions/6.html) _(Severity: High)_
- [CAPEC-15 — Command Delimiters](https://capec.mitre.org/data/definitions/15.html) _(Severity: High)_
- [CAPEC-43 — Exploiting Multiple Input Interpretation Layers](https://capec.mitre.org/data/definitions/43.html) _(Severity: High)_
- [CAPEC-71 — Using Unicode Encoding to Bypass Validation Logic](https://capec.mitre.org/data/definitions/71.html) _(Severity: High)_
- [CAPEC-73 — User-Controlled Filename](https://capec.mitre.org/data/definitions/73.html) _(Severity: High)_
- [CAPEC-120 — Double Encoding](https://capec.mitre.org/data/definitions/120.html) _(Severity: Medium)_
- [CAPEC-182 — Flash Injection](https://capec.mitre.org/data/definitions/182.html) _(Severity: Medium)_

## Patch verfügbar (OSV)

- 844252daed8d24ed6df016d1512e6a385ebb60aa (Commit)

## Referenzen

- <https://launchpad.net/bugs/2166876>
- <http://www.openwall.com/lists/oss-security/2026/09/24/5>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-97149/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_