CVE-2026-54330 ceph CVE debrief

Who should care

Ceph Object Gateway users, administrators, and security teams should be aware of this vulnerability and take necessary actions to protect their deployments. This includes verifying potential exposure, applying patches or updates, and monitoring for suspicious activity. Additionally, reviewing and restricting presigned URL permissions can help mitigate the risk.

Technical summary

The Ceph Object Gateway (RGW) SigV4 handler does not properly validate and reject requests carrying unsigned x-amz-* headers, allowing an attacker to escalate privileges by adding such headers to a presigned PUT URL. This vulnerability affects Ceph versions prior to 20.2.4 and 19.2.6. The issue is fixed in versions 20.2.4 and 19.2.6, where the handler now correctly validates and rejects requests with unsigned headers.

Defensive priority

Ceph Object Gateway SigV4 handler vulnerability allows privilege escalation via presigned URLs.

Recommended defensive actions

• Inventory Ceph Object Gateway installations for potential exposure
• Apply patches or updates to versions 20.2.4 or 19.2.6
• Monitor for suspicious presigned URL usage
• Review and restrict presigned URL permissions
• Implement compensating controls for unsigned headers
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The Ceph Object Gateway (RGW) SigV4 handler does not reject requests with unsigned x-amz-* headers, allowing privilege escalation. Fixed in versions 20.2.4 and 19.2.6. This issue was identified in Ceph versions prior to 20.2.4 and 19.2.6. The vulnerability allows an attacker to add arbitrary unsigned x-amz-* headers to a presigned PUT URL, potentially escalating privileges. Users should verify their Ceph Object Gateway deployments for potential exposure and apply patches or updates to versions 20.2.4 or 19.2.6. Additionally, monitoring for suspicious presigned URL usage and reviewing presigned URL permissions are recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.