CVE-2022-47950: OpenStack Swift XML External Entities (XXE) Injection Vulnerability
Summary
CVE-2022-47950: OpenStack Swift XML external entities (XXE) Injection. Affects swift across 3 version ranges.
< 2.28.1
>= 2.29.0, < 2.29.2
>= 2.30.0, < 2.30.1
Fixed in 2.28.1, 2.29.2 or 2.30.1, depending on the release line you run. How to fix ↓
Also tracked for
- swift · Debian:11
The same CVE-2022-47950 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Swift is an open-source object storage system designed for scalability and redundancy. It allows users to store and retrieve large amounts of data efficiently. Swift supports various APIs, including the S3 API, which is widely used for cloud storage solutions. However, certain versions of Swift are vulnerable to XML External Entities (XXE) injection, which can lead to unauthorized data access.
Vulnerability Detail
An issue was discovered in OpenStack Swift versions prior to 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user can manipulate the S3 API to return arbitrary file contents from the host server. This results in unauthorized read access to potentially sensitive data, impacting both s3api deployments (Rocky or later) and swift3 deployments (Queens and earlier). The vulnerability arises from improper handling of XML input, allowing attackers to exploit the system's XML parser.
How To Fix
Latest published version: 2.38.3 as of 22 Oct 2026
pip install --upgrade "swift==2.38.3"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.28.12.28.1pip install --upgrade "swift==2.28.1" -
>= 2.29.0, < 2.29.22.29.2pip install --upgrade "swift==2.29.2" -
>= 2.30.0, < 2.30.12.30.1pip install --upgrade "swift==2.30.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the S3 API or restricting access to trusted users only until the update can be applied. Additionally, validate and sanitize all XML inputs to prevent exploitation.
Conclusion
The OpenStack Swift XML External Entities (XXE) Injection vulnerability (CVE-2022-47950) poses a serious risk to data security in affected versions. It is crucial for users to update their Swift installations to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for swift →
FAQ
CVE-2022-47950 is a vulnerability in OpenStack Swift that allows an authenticated user to exploit XML external entities (XXE) to access unauthorized data.
OpenStack Swift versions before 2.28.1, 2.29.x before 2.29.2, and 2.30.0 are affected by this vulnerability.
The vulnerability can lead to unauthorized read access to sensitive data stored on the server, posing a significant security risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for swift.
