Vulnerability · Published Aug 27, 2026 · Assigned by GitHub_M
CVE-2026-54330Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
High 8.1
In plain English
A high-severity security flaw in ceph from ceph. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ceph | no fix listed | DEBIAN-CVE-2026-54330 |
| Debian:13 | ceph | no fix listed | DEBIAN-CVE-2026-54330 |
| Debian:14 | ceph | 20.2.4+ds-1 | DEBIAN-CVE-2026-54330 |
| Ubuntu:22.04:LTS | ceph | 17.2.9-0ubuntu0.22.04.4 | UBUNTU-CVE-2026-54330 |
| Ubuntu:22.04:LTS | ceph | 17.2.9-0ubuntu0.22.04.4 | USN-8867-1 |
| Ubuntu:24.04:LTS | ceph | no fix listed | UBUNTU-CVE-2026-54330 |
| Ubuntu:26.04:LTS | ceph | 20.2.0-0ubuntu2.1 | USN-8867-1 |
| Ubuntu:26.04:LTS | ceph | 20.2.0-0ubuntu2.1 | UBUNTU-CVE-2026-54330 |
Affected products (as reported)
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N