CVE-2026-54330
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Ceph versions prior to 20.2.4 and 19.2.6, in the RGW SigV4 handler, do not reject requests carrying x-amz-* headers absent from the signed header set. This allows anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW honors, potentially leading to privilege escalation.
Risk Assessment
An attacker can exploit a presigned URL to gain more capabilities than intended by the signer, potentially leading to unauthorized data access and privilege escalation in the Ceph cluster.
Recommendation
Upgrade Ceph to version 20.2.4 or 19.2.6. Invalidate existing presigned URLs and educate users on secure URL generation.
Original NVD description (English source)
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.