CVE-2026-39944 in Ceph
Summary
by MITRE • 08/28/2026
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway (RGW) protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid STS token to tamper with it undetected and escalate to full RGW administrative access. Because the ciphertext is unauthenticated, the attacker can perform a CBC bit-flip on the acct_type, perm_type, and is_admin fields of their own token, and a forged is_admin value triggers a global administrative override that bypasses all capability checks. The attack is reachable remotely over the RGW S3 endpoint and is a self-contained modification of a token the attacker already possesses, requiring no encryption oracle and no network observation. It requires only a single valid STS token, which need not carry any elevated privileges, with STS enabled. This issue is fixed in versions 20.2.4 and 19.2.6.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
Ceph serves as a prominent open-source distributed storage platform designed to deliver object, block, and file storage capabilities across scalable infrastructure. Within this ecosystem, the RADOS Gateway acts as the interface for S3-compatible API access, managing authentication and authorization through Security Token Service mechanisms. In software versions prior to 20.2.4 and 19.2.6, a critical cryptographic implementation flaw exists within the handling of STS session tokens. The system employs an AES-128-CBC cipher mode for protecting these tokens but fails to implement any form of message authentication code or integrity check. This architectural oversight means that while the token contents are encrypted and thus not immediately readable in transit, they remain fully malleable to an adversary who possesses a valid ciphertext.
The technical core of this vulnerability lies in the properties of Cipher Block Chaining mode when used without authentication. AES-CBC is inherently susceptible to bit-flipping attacks if no integrity verification mechanism such as HMAC or GCM is applied. An attacker with access to any valid STS token can manipulate specific bits within the encrypted payload. By carefully calculating the necessary bit flips, an adversary can alter the decrypted plaintext values of critical fields including acct_type, perm_type, and specifically the is_admin flag. Because there is no MAC to detect these modifications, the RADOS Gateway accepts the tampered token as legitimate, effectively allowing the attacker to forge administrative credentials from a standard user credential set.
The operational impact of this flaw is severe, resulting in complete privilege escalation for any authenticated user with STS enabled. By modifying the is_admin field within their own session token, an attacker can trigger a global administrative override that bypasses all capability checks enforced by the RGW. This allows the adversary to gain full control over the storage cluster, including the ability to read, modify, or delete arbitrary data objects and manage user accounts. The attack vector is remote and accessible via the standard S3 endpoint, making it easily exploitable in internet-facing deployments without requiring complex network manipulation or side-channel observations.
This vulnerability aligns with CWE-295 Improper Certificate Validation and more specifically CWE-347 Improper Verification of Cryptographic Signature, as the system fails to verify that the encrypted data has not been altered during storage or transmission. From a threat modeling perspective using MITRE ATT&CK, this flaw facilitates Account Manipulation (T1098) by allowing an attacker to modify their own account attributes to gain higher privileges, and potentially Credential Access (T1528) if further exploitation of the administrative session is pursued. The attack does not require a chosen-plaintext oracle or network sniffing beyond obtaining one valid token; it relies solely on the mathematical properties of CBC mode and the absence of integrity protection.
To mitigate this risk, organizations running Ceph must immediately upgrade to version 20.2.4 or later for the Quincy release line, or version 19.2.6 or later for the Reef release line. These versions implement proper message authentication alongside encryption, ensuring that any tampering with session tokens is detected and rejected by the gateway. Until an upgrade can be performed, administrators should consider restricting access to RGW endpoints where possible and monitoring for anomalous administrative actions originating from standard user accounts, although these are imperfect compensations given the fundamental nature of the cryptographic flaw.