CVE-2026-54330
Fixed in a distro release EPSS <1%CVSS 8.1
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.
Products: ceph
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | ceph | no fix |
| Debian:13 | ceph | no fix |
| Debian:14 | ceph | 20.2.4+ds-1 |
| Red Hat:ceph_storage:8.1 | ceph | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-base | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-base-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-common | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-common-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-debugsource | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-exporter-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-fuse | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-fuse-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-immutable-object-cache | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-immutable-object-cache-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-mds-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-mgr-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-mib | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-mon-client-nvmeof-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-mon-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-osd-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-radosgw-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-resource-agents | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-selinux | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | ceph-test-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | cephadm | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | cephfs-mirror-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | cephfs-top | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | libcephfs-daemon-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | libcephfs-devel | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | libcephfs-proxy2 | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | libcephfs-proxy2-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | libcephfs2 | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | libcephfs2-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | libcephsqlite-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | librados-devel | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | librados-devel-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | librados2 | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | librados2-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | libradospp-devel | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | libradosstriper1 | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | libradosstriper1-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | librbd-devel | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | librbd1 | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | librbd1-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | librgw-devel | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | librgw2 | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | librgw2-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | python3-ceph-argparse | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | python3-ceph-common | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | python3-cephfs | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | python3-cephfs-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | python3-rados | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | python3-rados-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | python3-rbd | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | python3-rbd-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | python3-rgw | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | python3-rgw-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | rbd-fuse-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | rbd-mirror-debuginfo | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | rbd-nbd | 2:19.2.1-423.el9cp |
| Red Hat:ceph_storage:8.1 | rbd-nbd-debuginfo | 2:19.2.1-423.el9cp |
| Ubuntu:22.04:LTS | ceph | 17.2.9-0ubuntu0.22.04.4 |
| Ubuntu:24.04:LTS | ceph | no fix |
| Ubuntu:26.04:LTS | ceph | 20.2.0-0ubuntu2.1 |
| Ubuntu:Pro:18.04:LTS | ceph | 12.2.13-0ubuntu0.18.04.11+esm3 |
| Ubuntu:Pro:20.04:LTS | ceph | 15.2.17-0ubuntu0.20.04.6+esm2 |