CVE-2026-50221: OpenStack Swift Authenticated Server-Side Request Forgery Vulnerability
Summary
CVE-2026-50221: OpenStack Swift vulnerable to authenticated server-side request forgery. Affects swift versions < 2.37.2. Fixed in 2.37.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenStack Swift is an open-source object storage system designed for scalability and redundancy. It enables users to store and retrieve large amounts of unstructured data. Swift is widely used in cloud environments for its ability to handle vast data storage needs. However, it is susceptible to vulnerabilities that can compromise its security, such as the one described in this report.
Vulnerability Detail
In OpenStack Swift versions prior to 2.37.2, the proxy-server component fails to strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object servers. This oversight allows an authenticated user with write access to inject these headers, redirecting container update requests to an attacker-controlled server. The ramifications include server-side request forgery (SSRF), which can expose sensitive internal cluster metadata, such as storage policy indexes, partition mappings, and device names. Additionally, if container-level encryption is enabled, the attacker may gain access to cipher text and initialization vectors, leading to further security breaches.
How To Fix
Latest published version: 2.38.3 as of 22 Oct 2026
pip install --upgrade "swift==2.38.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.37.2
This is the first release that contains the fix.
pip install --upgrade "swift==2.37.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict write access to authenticated users until the package is updated. This can be done by modifying the access control policies in your Swift configuration to limit permissions for users who do not require write access.
Conclusion
The CVE-2026-50221 vulnerability in OpenStack Swift poses a significant risk due to its potential for server-side request forgery. Users are strongly advised to update to version 2.37.2 or later to mitigate this risk. Additionally, implementing access control measures can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for swift →
FAQ
CVE-2026-50221 is a vulnerability in OpenStack Swift that allows authenticated users to perform server-side request forgery by injecting internal update headers.
The vulnerability can lead to exposure of sensitive internal metadata and potentially allow attackers to manipulate data within the storage system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, the vulnerability is patched in OpenStack Swift version 2.37.2 and later. It is recommended to update to this version.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock, providing real-time insights without requiring access to the code.
Related vulnerabilities
Recent vulnerabilities recorded for swift.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
