An incomplete TempURL signature validation in OpenStack Swift allows a user with a valid PUT TempURL to insert an X‑Copy‑From header. Because the signature does not cover that header, the copy middleware silently copies the named object into the destination and the attacker can later read the victim’s data through a GET TempURL for the new location. The flaw is a CWE‑184 weakness in the TempURL middleware that permits unauthorized data transfer and confidentiality violation.

Systems running OpenStack Swift version earlier than 2.38.2 and deploying the default proxy pipeline that includes the tempurl and copy middleware with account‑level TempURL keys are affected. Only objects within the same account are susceptible, as cross‑account copies are rejected.

The vulnerability receives a CVSS base score of 5.3, indicating moderate risk. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting that exploitation is not widely known. The likely attack requires possession of a valid TempURL for a target object, which is typically granted to legitimate users or administrators, so the chance of exploitation depends on the availability of those credentials. The impact is limited to data confidentiality within the same account.