CVE-2026-94368
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header
A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 (SigV4). Due to improper validation, the service fails to reject requests containing unsigned x-amz- headers, instead simply dropping them from the signature calculation. This allows an attacker who possesses a valid presigned PUT URL to add an unsigned x-amz-copy-source header, effectively converting a simple upload into a CopyObject operation. This can lead to unauthorized access and copying of any data the original signer is permitted to reach across the entire storage system.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat Openshift Data Foundation 4
- Vendor
- Red Hat
- Product
- Red Hat Openshift Data Foundation 4
- Platforms
- Unknown
- Default status
affected- Package
- odf4/mcg-core-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Openshift Data Foundation 4
- Vendor
- Red Hat
- Product
- Red Hat Openshift Data Foundation 4
- Platforms
- Unknown
- Default status
affected- Package
- rhceph-dev/odf4-mcg-core-rhel9
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.