CVE-2026-50221: OpenStack Swift Authenticated Server-Side Request Forgery Vulnerability
Summary
CVE-2026-50221: OpenStack Swift vulnerable to authenticated server-side request forgery. Affects swift versions < 2.37.2. Fixed in 2.37.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Swift is an open-source object storage system designed for scalability and redundancy. It allows users to store and retrieve large amounts of data efficiently. Swift is widely used in cloud environments for its ability to manage unstructured data. However, prior to version 2.37.2, Swift's proxy-server had a critical vulnerability that could be exploited by authenticated users with write access.
Vulnerability Detail
In OpenStack Swift versions before 2.37.2, the proxy-server fails to strip certain internal update headers from client requests before forwarding them to object-servers. This oversight allows an authenticated user to inject headers such as X-Container-Host and X-Delete-At-Host, redirecting container update requests to a server controlled by the attacker. This server-side request forgery (SSRF) can expose sensitive internal cluster metadata, including storage policy indexes and device names, and can also lead to unauthorized access to encryption keys. The vulnerability is classified under CWE-918.
How To Fix
Latest published version: 2.38.3 as of 22 Oct 2026
pip install --upgrade "swift==2.38.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.37.2
This is the first release that contains the fix.
pip install --upgrade "swift==2.37.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict write access to trusted users only. This can help mitigate the risk of exploitation until the package is updated. Additionally, consider implementing network-level controls to limit access to internal servers.
Conclusion
The CVE-2026-50221 vulnerability in OpenStack Swift poses a significant risk due to its potential for server-side request forgery. It is crucial for users to update to version 2.37.2 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for swift →
FAQ
CVE-2026-50221 is a vulnerability in OpenStack Swift that allows authenticated users to perform server-side request forgery by injecting internal update headers.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring sign-up.
Exploitation of this vulnerability can lead to exposure of sensitive internal metadata and unauthorized access to encryption keys, potentially compromising the security of your data.
Yes, the vulnerability is patched in OpenStack Swift version 2.37.2. It is recommended to upgrade to this version or later.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock. It helps you stay informed about potential security risks.
Related vulnerabilities
Recent vulnerabilities recorded for swift.
