Ceph up to 19.2.5/20.2.3 SigV4 privileges management

Summaryinfo

A vulnerability categorized as critical has been discovered in Ceph up to 19.2.5/20.2.3. Affected by this vulnerability is an unknown functionality of the component SigV4 Handler. Executing a manipulation can lead to privileges management. This vulnerability appears as CVE-2026-54330. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in Ceph up to 19.2.5/20.2.3 and classified as critical. This vulnerability affects an unknown functionality of the component SigV4 Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.

The advisory is available at github.com. This vulnerability was named CVE-2026-54330 since 06/12/2026. The exploitation appears to be easy. The attack can be initiated remotely. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading to version 19.2.6 or 20.2.4 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Ceph

Version

• 19.2.0
• 19.2.1
• 19.2.2
• 19.2.3
• 19.2.4
• 19.2.5
• 20.2.0
• 20.2.1
• 20.2.2
• 20.2.3

Website

• Product: https://github.com/ceph/ceph/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion