CVE-2026-54330
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.
- Record
CVE-2026-54330- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2026-67276
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.
- Record
EUVD-2026-67276- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
NVD
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.
- Record
CVE-2026-54330- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSV
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.
- Record
CVE-2026-54330- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-54330
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.
- Record
DEBIAN-CVE-2026-54330- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2026:79101
Red Hat Security Advisory: Red Hat Ceph Storage 8.1 security and bug fix updates
- Record
RHSA-2026:79101- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2026-54330
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.
- Record
UBUNTU-CVE-2026-54330- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVAZL-98340 No score
CVE-2026-54330 affecting package ceph for versions less than 18.2.2-13
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.
- Record
AZL-98340- Updated
- 2026-11-05
OSVBIT-ceph-2026-54330 No score
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.
- Record
BIT-ceph-2026-54330- Updated
- 2026-11-02
OSVMGASA-2026-0389 No score
Updated ceph packages fix security vulnerabilities
Updated ceph packages fix various security issues allowing authentication bypasses to gain admin privileges on the OSD, MDS, and MGR services. Notice that some of the fixes require kernel support for aes256k (introduced in kernel 7). This update will not break installs using the old (and insecure) AES keys; warnings will appear to migrate all keys (check out "ceph health detail" or "ceph status").
- Record
MGASA-2026-0389- Updated
- 2026-11-02
OSVUSN-8867-1 No score
ceph vulnerability
It was discovered that the Ceph Object Gateway (RGW) SigV4 handler did not reject requests carrying x-amz-* headers that were absent from the signed header set. An attacker holding a presigned URL could possibly use this issue to attach arbitrary unsigned x-amz-* headers that RGW would honor, allowing them to escalate their privileges beyond what the URL's signer intended.
- Record
USN-8867-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cephAzure Linux:3 |
before 18.2.2-13 | 18.2.2-13 |
cephBitnami |
19.0.0 up to 19.2.6, 20.0.0 up to 20.2.4 | 19.2.620.2.4 |
cephDebian:12 |
All versions, plus listed versions 16.2.11+ds-216.2.11+ds-316.2.11+ds-416.2.11+ds-516.2.11+ds-5.1 Show 45 moreShow less16.2.15+ds-0+deb12u116.2.15+ds-0+deb12u218.2.0+ds-118.2.0+ds-218.2.0+ds-318.2.0+ds-418.2.0+ds-518.2.0+ds-618.2.0+ds-718.2.0+ds-818.2.1+ds-118.2.1+ds-218.2.1+ds-318.2.1+ds-418.2.1+ds-518.2.1+ds-618.2.1+ds-718.2.1+ds-818.2.1+ds-918.2.3+ds-118.2.3+ds-218.2.3+ds-318.2.3+ds-3+loong6418.2.4+ds-118.2.4+ds-1018.2.4+ds-1118.2.4+ds-1218.2.4+ds-1318.2.4+ds-218.2.4+ds-318.2.4+ds-418.2.4+ds-518.2.4+ds-618.2.4+ds-718.2.4+ds-818.2.4+ds-918.2.6-118.2.7+ds-118.2.7+ds-1.118.2.7-118.2.7-218.2.8+ds-118.2.8+ds-218.2.8+ds-2.120.2.2+ds-1 |
None known |
cephDebian:13 |
All versions, plus listed versions 18.2.7+ds-118.2.7+ds-1+deb13u118.2.7+ds-1.118.2.8+ds-118.2.8+ds-2 Show 15 moreShow less18.2.8+ds-2.120.2.2+ds-120.2.2+ds-1020.2.2+ds-1120.2.2+ds-1220.2.2+ds-1320.2.2+ds-220.2.2+ds-320.2.2+ds-420.2.2+ds-520.2.2+ds-620.2.2+ds-720.2.2+ds-820.2.2+ds-920.2.4+ds-1 |
None known |
cephDebian:14 |
before 20.2.4+ds-1, plus listed versions 18.2.7+ds-118.2.7+ds-1.118.2.8+ds-118.2.8+ds-218.2.8+ds-2.1 Show 13 moreShow less20.2.2+ds-120.2.2+ds-1020.2.2+ds-1120.2.2+ds-1220.2.2+ds-1320.2.2+ds-220.2.2+ds-320.2.2+ds-420.2.2+ds-520.2.2+ds-620.2.2+ds-720.2.2+ds-820.2.2+ds-9 |
20.2.4+ds-1 |
cephMageia:10 From an advisory covering 4 CVEs |
before 20.2.4-1.mga10 | 20.2.4-1.mga10 |
cephRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-baseRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-base-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-commonRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
Show 60 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ceph-common-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-debugsourceRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-exporter-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-fuseRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-fuse-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-immutable-object-cacheRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-immutable-object-cache-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-mds-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-mgr-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-mibRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-mon-client-nvmeof-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-mon-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-osd-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-radosgw-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-resource-agentsRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-selinuxRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
ceph-test-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
cephadmRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
cephfs-mirror-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
cephfs-topRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
libcephfs-daemon-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
libcephfs-develRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
libcephfs-proxy2Red Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
libcephfs-proxy2-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
libcephfs2Red Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
libcephfs2-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
libcephsqlite-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
librados-develRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
librados-devel-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
librados2Red Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
librados2-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
libradospp-develRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
libradosstriper1Red Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
libradosstriper1-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
librbd-develRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
librbd1Red Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
librbd1-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
librgw-develRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
librgw2Red Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
librgw2-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
python3-ceph-argparseRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
python3-ceph-commonRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
python3-cephfsRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
python3-cephfs-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
python3-radosRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
python3-rados-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
python3-rbdRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
python3-rbd-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
python3-rgwRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
python3-rgw-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
rbd-fuse-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
rbd-mirror-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
rbd-nbdRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
rbd-nbd-debuginfoRed Hat:ceph_storage:8.1::el9 From an advisory covering 6 CVEs |
before 2:19.2.1-423.el9cp | 2:19.2.1-423.el9cp |
cephUbuntu:Pro:18.04:LTS |
before 12.2.13-0ubuntu0.18.04.11+esm3, plus listed versions 12.2.0-0ubuntu112.2.1-0ubuntu112.2.2-0ubuntu112.2.2-0ubuntu212.2.4-0ubuntu1 Show 22 moreShow less12.2.4-0ubuntu1.112.2.7-0ubuntu0.18.04.112.2.8-0ubuntu0.18.04.112.2.8-0ubuntu0.18.04.212.2.11-0ubuntu0.18.04.112.2.11-0ubuntu0.18.04.212.2.12-0ubuntu0.18.04.112.2.12-0ubuntu0.18.04.212.2.12-0ubuntu0.18.04.312.2.12-0ubuntu0.18.04.412.2.12-0ubuntu0.18.04.512.2.13-0ubuntu0.18.04.212.2.13-0ubuntu0.18.04.312.2.13-0ubuntu0.18.04.412.2.13-0ubuntu0.18.04.512.2.13-0ubuntu0.18.04.612.2.13-0ubuntu0.18.04.712.2.13-0ubuntu0.18.04.812.2.13-0ubuntu0.18.04.1012.2.13-0ubuntu0.18.04.1112.2.13-0ubuntu0.18.04.11+esm112.2.13-0ubuntu0.18.04.11+esm2 |
12.2.13-0ubuntu0.18.04.11+esm3 |
cephUbuntu:Pro:20.04:LTS |
before 15.2.17-0ubuntu0.20.04.6+esm2, plus listed versions 14.2.2-0ubuntu314.2.2-0ubuntu414.2.4-0ubuntu114.2.4-0ubuntu214.2.4-0ubuntu3 Show 26 moreShow less15.1.0-0ubuntu215.1.0-0ubuntu315.1.1-0ubuntu115.2.0-0ubuntu115.2.0-0ubuntu215.2.1-0ubuntu115.2.1-0ubuntu215.2.3-0ubuntu0.20.04.115.2.3-0ubuntu0.20.04.215.2.5-0ubuntu0.20.04.115.2.7-0ubuntu0.20.04.115.2.7-0ubuntu0.20.04.215.2.8-0ubuntu0.20.04.115.2.11-0ubuntu0.20.04.215.2.12-0ubuntu0.20.04.115.2.13-0ubuntu0.20.04.115.2.13-0ubuntu0.20.04.215.2.14-0ubuntu0.20.04.115.2.14-0ubuntu0.20.04.215.2.16-0ubuntu0.20.04.115.2.17-0ubuntu0.20.04.115.2.17-0ubuntu0.20.04.315.2.17-0ubuntu0.20.04.415.2.17-0ubuntu0.20.04.515.2.17-0ubuntu0.20.04.615.2.17-0ubuntu0.20.04.6+esm1 |
15.2.17-0ubuntu0.20.04.6+esm2 |
cephUbuntu:22.04:LTS |
before 17.2.9-0ubuntu0.22.04.4, plus listed versions 16.2.6-0ubuntu116.2.6-0ubuntu216.2.6-0ubuntu316.2.7-0ubuntu116.2.7-0ubuntu4 Show 15 moreShow less17.1.0-0ubuntu117.1.0-0ubuntu217.1.0-0ubuntu317.2.0-0ubuntu0.22.04.117.2.0-0ubuntu0.22.04.217.2.5-0ubuntu0.22.04.217.2.5-0ubuntu0.22.04.317.2.6-0ubuntu0.22.04.117.2.6-0ubuntu0.22.04.217.2.6-0ubuntu0.22.04.317.2.7-0ubuntu0.22.04.117.2.7-0ubuntu0.22.04.217.2.9-0ubuntu0.22.04.117.2.9-0ubuntu0.22.04.217.2.9-0ubuntu0.22.04.3 |
17.2.9-0ubuntu0.22.04.4 |
cephUbuntu:24.04:LTS |
All versions, plus listed versions 18.2.0-0ubuntu318.2.0-0ubuntu618.2.0-0ubuntu719.2.0~git20240301.4c76c50-0ubuntu319.2.0~git20240301.4c76c50-0ubuntu4 Show 8 moreShow less19.2.0~git20240301.4c76c50-0ubuntu619.2.0~git20240301.4c76c50-0ubuntu6.119.2.0-0ubuntu0.24.04.119.2.0-0ubuntu0.24.04.219.2.1-0ubuntu0.24.04.219.2.3-0ubuntu0.24.04.119.2.3-0ubuntu0.24.04.219.2.3-0ubuntu0.24.04.3 |
None known |
cephUbuntu:26.04:LTS |
before 20.2.0-0ubuntu2.1, plus listed versions 19.2.1-0ubuntu319.2.3-0ubuntu219.2.3-0ubuntu319.2.3-0ubuntu420.2.0-0ubuntu120.2.0-0ubuntu2 |
20.2.0-0ubuntu2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-54330 is a high vulnerability (CVSS 8.1) in Ceph, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in ceph 18.2.2-13.
References
github.com/ceph/ceph/security/advisories/GHSA-rmjq-ffrm-j6vj
nvd.nist.gov/vuln/detail/CVE-2026-54330
security-tracker.debian.org/tracker/CVE-2026-54330
Show 44 moreShow less
advisories.mageia.org/MGASA-2026-0389.html
bugs.mageia.org/show_bug.cgi?id=36147
docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.html
openwall.com/lists/oss-security/2026/08/19/4
web.mit.edu/tlyu/papers/krb4peril-ndss04.pdf
access.redhat.com/errata/RHSA-2026:79101
bugzilla.redhat.com/show_bug.cgi?id=2254210
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79101.json
cve.org/CVERecord?id=CVE-2023-48795
terrapin-attack.com
tracker.ceph.com/issues/68836
ubuntu.com/security/CVE-2026-54330
Left out here: 13 versions. The JSON record has them.