CVE Alert: CVE-2026-94368 – Red Hat

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 (SigV4). Due to improper validation, the service fails to reject requests containing unsigned x-amz- headers, instead simply dropping them from the signature calculation. This allows an attacker who possesses a valid presigned PUT URL to add an unsigned x-amz-copy-source header, effectively converting a simple upload into a CopyObject operation. This can lead to unauthorized access and copying of any data the original signer is permitted to reach across the entire storage system.

Treat this as a high-priority exposure requiring prompt remediation, although no KEV, active-exploitation, PoC, or EPSS data is supplied to confirm exploitation urgency.

An attacker with a valid presigned upload capability may repurpose it to copy objects that the signing identity can access, bypassing the intended upload-only constraint. The principal risk is unauthorised disclosure of sensitive object data, with limited integrity impact through placement or manipulation of copied content.

### Most likely attack path

The attack is remotely reachable, requires low complexity and limited existing privilege, and needs no victim interaction. An attacker obtains or reuses a presigned PUT URL, adds an unsigned copy-source header, and causes the gateway to perform a copy under the signer’s permissions; scope remains within the service’s authority, but the accessible storage estate may be broad.

### Who is most exposed

Organisations using the gateway for shared, multi-tenant, backup, analytics, or application-upload workloads are most exposed, particularly where presigned URLs are distributed externally or have generous lifetimes.

Alert on PUT requests carrying `x-amz-copy-source`.

Identify copy operations authenticated through presigned URLs.

Correlate unusual source and destination buckets, prefixes, or tenants.

Review object-access logs for bulk reads or copies by upload-only identities.

Hunt for externally issued URLs followed by unexpected object creation.

### Mitigation and prioritisation

Apply the vendor’s corrective update as soon as it is available and validated.

Treat compensating controls as temporary; the advisory states no generally suitable workaround.

Restrict presigned URL lifetime, scope, source networks, and signing permissions.

Separate upload identities from read or copy privileges.

Test changes in representative storage workflows before staged production deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.