A flaw in the signature verification logic of noobaa-core allows unsigned x-amz-copy-source headers to be ignored during Signature Version 4 validation, enabling an attacker with a valid presigned PUT URL to elevate a simple upload into a CopyObject operation. This results in unauthorized data replication and potentially broader data exposure. The weakness falls under CWE‑347, indicating improper validation of supplied input.

The vulnerability affects Red Hat OpenShift Data Foundation 4, specifically the noobaa-core component of the NooBaa Multicloud Object Gateway. No specific version information is disclosed, so any deployed instance of that component is potentially impacted.

With a CVSS score of 7.1, the flaw is high severity, though its EPSS score is not available and it is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to possess a valid presigned PUT URL and to add an unsigned x-amz-copy-source header, converting the request to a CopyObject operation. The attack can proceed without additional authentication and can affect any data the original presigner is authorized to access.