An incomplete TempURL signature validation in OpenStack Swift allows a user with a valid PUT TempURL to insert an X‑Copy‑From header. Because the signature does not cover that header, the copy middleware silently copies the named object into the destination and the attacker can later read the victim’s data through a GET TempURL for the new location. The flaw is a weakness in the TempURL middleware that permits unauthorized data transfer and confidentiality violation.

Systems running OpenStack Swift version earlier than 2.38.2 and deploying the default proxy pipeline that includes the tempurl and copy middleware with account‑level TempURL keys are affected. Only objects within the same account are susceptible, as cross‑account copies are rejected.

The vulnerability receives a CVSS base score of 5.3, indicating moderate risk. EPSS data is under 1%, suggesting exploitation is unlikely to be widespread, and the flaw is not listed in the CISA KEV catalog. The likely attack requires possession of a valid TempURL for a target object, which is typically granted to legitimate users or administrators; the impact therefore is limited to data confidentiality within the same account.