These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-28T00:18:07.683Z and has not been modified since then. The Ceph Object Gateway (RGW) SigV4 handler does not properly validate and reject requests carrying unsigned x-amz-* headers, allowing an attacker to escalate privileges by adding such headers to a presigned PUT URL. This vulnerability affects C [truncated]
The CVE-2026-50152 vulnerability affects Ceph, an open-source distributed storage platform, specifically in versions prior to 20.2.4 and 19.2.6. This vulnerability class involves improper authorization in the Monitor subscription handler, allowing any CephX user with `mon allow r` capabilities to read the entire configuration-key store by sending a crafted MMonSubscribe message. The configuration-key stor [truncated]
The RADOS Gateway (RGW) in Ceph versions prior to 20.2.4 and 19.2.6 uses an insecure AES-128-CBC handler to protect STS session tokens, lacking message authentication. This allows attackers to tamper with tokens undetected, escalating to full RGW administrative access. The attack is reachable remotely over the RGW S3 endpoint and requires only a single valid STS token with STS enabled. Ceph administrators [truncated]
The CVE-2025-30156 vulnerability affects Ceph, an open-source distributed storage platform, specifically in its CephX authentication protocol. This protocol uses AES-128-CBC in an unauthenticated mode with a hard-coded initialization vector and no message authentication, allowing an attacker to forge credentials and gain cluster-wide access. The vulnerability impacts Ceph users and administrators, as well [truncated]