Critical Flaw in NooBaa Multicloud Gateway Exposes Data to Unauthorized Access

• •CVE-2026-94368 allows unauthorized data access via presigned URLs.
• •Attackers can exploit the flaw without needing high privileges.
• •No effective mitigation is currently available from Red Hat.

A significant vulnerability (CVE-2026-94368) has been identified in the noobaa-core component of the NooBaa Multicloud Object Gateway. This flaw affects the processing of S3 presigned URLs using Signature Version 4, allowing attackers with valid presigned PUT URLs to exploit the service by adding unsigned x-amz-copy-source headers. This can convert upload operations into CopyObject requests, enabling unauthorized access to data across the storage system. The Red Hat Product Security team has classified this vulnerability as Important, highlighting the risk of unauthorized data disclosure and potential data manipulation. Currently, no effective mitigation is available, and organizations using the gateway for shared or multi-tenant workloads are particularly vulnerable. The flaw's root cause is improper validation of x-amz- headers in requests. Red Hat has acknowledged the issue and is working on a resolution.