OVH Cloud Object Storage

0 indexed

OVH Cloud Object Storage runs on OpenStack Swift with an S3-compatible facade. Buckets at `<region>.cloud.ovh.net` (Swift) and `s3.<region>.cloud.ovh.net` (S3) become readable when the container ACL grants `.r:*`.

OVH Cloud Object Storage exposure data

Total tracked

Currently open

The trend chart appears once at least 7 days of history accrue.

Aggregate figures only. See the full open-buckets data across all providers.

Common misconfiguration class

OVH operators are split between Swift and S3 APIs, and a hardening change on one API surface doesn't always apply to the other. The Swift `.r:*` ACL persists even after S3-side hardening.

Real-world impact

Public read on the container exposes the object list and contents through either API endpoint.

Remediation

Remove `.r:*` from the Swift container ACL via `swift post -r ""`.
Re-test exposure on both `cloud.ovh.net` and `s3.cloud.ovh.net` endpoints after any change.

URL patterns

OVH Cloud Object Storage buckets typically resolve under hostnames like:

storage.gra.cloud.ovh.net/v1/AUTH_<project>/example/

Check a specific OVH Cloud Object Storage URL

Paste any OVH Cloud Object Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.

Open the Viewer

Own a listed OVH Cloud Object Storage bucket?

If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.

Submit takedown request