CVE-2026-50221: OpenStack Swift SSRF via header injection in proxy-server

CVE-2026-50221 · Severity: medium · CVSS 5.4 · Published 2026-06-23

OpenStack Swift, a widely used cloud storage system, contains a security flaw in its proxy server component. An authorized user with write access can trick the system into sending internal data to an external server they control. This could lead to the exposure of sensitive technical details about the storage infrastructure or the creation of 'ghost' files that disrupt data organization.

Technologies: OpenStack Swift, swift (PyPI). Vendors: OpenStack, PyPI.

Quick answers

Is CVE-2026-50221 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50221 being exploited in the wild.
How severe is CVE-2026-50221?
Medium severity, with a CVSS score of 5.4, published 23 June 2026.
Which products and versions are affected?
OpenStack Swift >=2.0.0 <2.35.3, >=2.36.0 <2.36.2, >=2.37.0 <2.37.2; swift (PyPI) ECOSYSTEM:introduced=0,fixed=2.37.2.
Is there a fix for CVE-2026-50221?
Yes. swift (PyPI): upgrade to 2.37.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50221 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-50221?
Check whether you run OpenStack Swift or swift (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • swift (PyPI): upgrade to 2.37.2 or later
    pip install "swift>=2.37.2"

Technical details

A server-side request forgery (SSRF) vulnerability exists in the OpenStack Swift proxy-server because it fails to strip internal update headers (such as X-Container-Host and X-Delete-At-Host) from client requests. An authenticated attacker with write permissions can inject these headers to redirect container update requests from internal object servers to an external, attacker-controlled host. This exploit can leak sensitive cluster metadata, including storage policy indexes, partition mappings, and encryption initialization vectors. It also allows for the creation of 'ghost listings' via the shard-range redirect mechanism. The issue is fixed in versions 2.35.3, 2.36.2, and 2.37.2.

Affected products

  • OpenStack Swift >=2.0.0 <2.35.3, >=2.36.0 <2.36.2, >=2.37.0 <2.37.2

Identifiers

  • CVE-2026-50221
  • GHSA-h8rc-w822-q8vq
  • PYSEC-2026-4173

Timeline

  • 2026-04-24: disclosed: Bug reported to OpenStack by Tim Shephard
  • 2026-06-23: advisory: OSSA-2026-024 published
  • 2026-06-23: patched: Fixes released in multiple branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.