{"id":"CVE-2026-54330","aliases":["AZL-98340","BIT-ceph-2026-54330","DEBIAN-CVE-2026-54330","EUVD-2026-67276","GHSA-rmjq-ffrm-j6vj","MGASA-2026-0389","RHSA-2026:79101","UBUNTU-CVE-2026-54330","USN-8867-1"],"status":"published","title":"Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00367,"percentile":0.30994,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2026-08-27T20:59:24Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"ceph","fixed_in":["18.2.2-13"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"ceph","fixed_in":["19.2.6","20.2.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ceph","fixed_in":["20.2.4+ds-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ceph","fixed_in":["12.2.13-0ubuntu0.18.04.11+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ceph","fixed_in":["15.2.17-0ubuntu0.20.04.6+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ceph","fixed_in":["17.2.9-0ubuntu0.22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"ceph","fixed_in":["20.2.0-0ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2.2-13"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"ceph","ranges":[{"type":"SEMVER","events":[{"introduced":"19.0.0"},{"fixed":"19.2.6"},{"introduced":"20.0.0"},{"fixed":"20.2.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.2.11+ds-2","16.2.11+ds-3","16.2.11+ds-4","16.2.11+ds-5","16.2.11+ds-5.1","16.2.15+ds-0+deb12u1","16.2.15+ds-0+deb12u2","18.2.0+ds-1","18.2.0+ds-2","18.2.0+ds-3","18.2.0+ds-4","18.2.0+ds-5","18.2.0+ds-6","18.2.0+ds-7","18.2.0+ds-8","18.2.1+ds-1","18.2.1+ds-2","18.2.1+ds-3","18.2.1+ds-4","18.2.1+ds-5","18.2.1+ds-6","18.2.1+ds-7","18.2.1+ds-8","18.2.1+ds-9","18.2.3+ds-1","18.2.3+ds-2","18.2.3+ds-3","18.2.3+ds-3+loong64","18.2.4+ds-1","18.2.4+ds-10","18.2.4+ds-11","18.2.4+ds-12","18.2.4+ds-13","18.2.4+ds-2","18.2.4+ds-3","18.2.4+ds-4","18.2.4+ds-5","18.2.4+ds-6","18.2.4+ds-7","18.2.4+ds-8","18.2.4+ds-9","18.2.6-1","18.2.7+ds-1","18.2.7+ds-1.1","18.2.7-1","18.2.7-2","18.2.8+ds-1","18.2.8+ds-2","18.2.8+ds-2.1","20.2.2+ds-1","20.2.2+ds-10","20.2.2+ds-11","20.2.2+ds-12","20.2.2+ds-13","20.2.2+ds-2","20.2.2+ds-3","20.2.2+ds-4","20.2.2+ds-5","20.2.2+ds-6","20.2.2+ds-7","20.2.2+ds-8","20.2.2+ds-9","20.2.4+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.2.7+ds-1","18.2.7+ds-1+deb13u1","18.2.7+ds-1.1","18.2.8+ds-1","18.2.8+ds-2","18.2.8+ds-2.1","20.2.2+ds-1","20.2.2+ds-10","20.2.2+ds-11","20.2.2+ds-12","20.2.2+ds-13","20.2.2+ds-2","20.2.2+ds-3","20.2.2+ds-4","20.2.2+ds-5","20.2.2+ds-6","20.2.2+ds-7","20.2.2+ds-8","20.2.2+ds-9","20.2.4+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.2.4+ds-1"}]}],"versions":["18.2.7+ds-1","18.2.7+ds-1.1","18.2.8+ds-1","18.2.8+ds-2","18.2.8+ds-2.1","20.2.2+ds-1","20.2.2+ds-10","20.2.2+ds-11","20.2.2+ds-12","20.2.2+ds-13","20.2.2+ds-2","20.2.2+ds-3","20.2.2+ds-4","20.2.2+ds-5","20.2.2+ds-6","20.2.2+ds-7","20.2.2+ds-8","20.2.2+ds-9"]},{"source":"osv","ecosystem":"Mageia:10","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.2.4-1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-exporter-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-immutable-object-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-immutable-object-cache-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-mds-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-mgr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-mib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-mon-client-nvmeof-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-mon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-osd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-radosgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"cephadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"cephfs-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"cephfs-top","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephfs-daemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephfs-proxy2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephfs-proxy2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephfs2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephsqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librados-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librados2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libradospp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libradosstriper1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librbd1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librgw2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-ceph-argparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-cephfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-rados-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-rbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-rgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"rbd-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"rbd-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"rbd-nbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"rbd-nbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.13-0ubuntu0.18.04.11+esm3"}]}],"versions":["12.2.0-0ubuntu1","12.2.1-0ubuntu1","12.2.2-0ubuntu1","12.2.2-0ubuntu2","12.2.4-0ubuntu1","12.2.4-0ubuntu1.1","12.2.7-0ubuntu0.18.04.1","12.2.8-0ubuntu0.18.04.1","12.2.8-0ubuntu0.18.04.2","12.2.11-0ubuntu0.18.04.1","12.2.11-0ubuntu0.18.04.2","12.2.12-0ubuntu0.18.04.1","12.2.12-0ubuntu0.18.04.2","12.2.12-0ubuntu0.18.04.3","12.2.12-0ubuntu0.18.04.4","12.2.12-0ubuntu0.18.04.5","12.2.13-0ubuntu0.18.04.2","12.2.13-0ubuntu0.18.04.3","12.2.13-0ubuntu0.18.04.4","12.2.13-0ubuntu0.18.04.5","12.2.13-0ubuntu0.18.04.6","12.2.13-0ubuntu0.18.04.7","12.2.13-0ubuntu0.18.04.8","12.2.13-0ubuntu0.18.04.10","12.2.13-0ubuntu0.18.04.11","12.2.13-0ubuntu0.18.04.11+esm1","12.2.13-0ubuntu0.18.04.11+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.17-0ubuntu0.20.04.6+esm2"}]}],"versions":["14.2.2-0ubuntu3","14.2.2-0ubuntu4","14.2.4-0ubuntu1","14.2.4-0ubuntu2","14.2.4-0ubuntu3","15.1.0-0ubuntu2","15.1.0-0ubuntu3","15.1.1-0ubuntu1","15.2.0-0ubuntu1","15.2.0-0ubuntu2","15.2.1-0ubuntu1","15.2.1-0ubuntu2","15.2.3-0ubuntu0.20.04.1","15.2.3-0ubuntu0.20.04.2","15.2.5-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.2","15.2.8-0ubuntu0.20.04.1","15.2.11-0ubuntu0.20.04.2","15.2.12-0ubuntu0.20.04.1","15.2.13-0ubuntu0.20.04.1","15.2.13-0ubuntu0.20.04.2","15.2.14-0ubuntu0.20.04.1","15.2.14-0ubuntu0.20.04.2","15.2.16-0ubuntu0.20.04.1","15.2.17-0ubuntu0.20.04.1","15.2.17-0ubuntu0.20.04.3","15.2.17-0ubuntu0.20.04.4","15.2.17-0ubuntu0.20.04.5","15.2.17-0ubuntu0.20.04.6","15.2.17-0ubuntu0.20.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.2.9-0ubuntu0.22.04.4"}]}],"versions":["16.2.6-0ubuntu1","16.2.6-0ubuntu2","16.2.6-0ubuntu3","16.2.7-0ubuntu1","16.2.7-0ubuntu4","17.1.0-0ubuntu1","17.1.0-0ubuntu2","17.1.0-0ubuntu3","17.2.0-0ubuntu0.22.04.1","17.2.0-0ubuntu0.22.04.2","17.2.5-0ubuntu0.22.04.2","17.2.5-0ubuntu0.22.04.3","17.2.6-0ubuntu0.22.04.1","17.2.6-0ubuntu0.22.04.2","17.2.6-0ubuntu0.22.04.3","17.2.7-0ubuntu0.22.04.1","17.2.7-0ubuntu0.22.04.2","17.2.9-0ubuntu0.22.04.1","17.2.9-0ubuntu0.22.04.2","17.2.9-0ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.2.0-0ubuntu3","18.2.0-0ubuntu6","18.2.0-0ubuntu7","19.2.0~git20240301.4c76c50-0ubuntu3","19.2.0~git20240301.4c76c50-0ubuntu4","19.2.0~git20240301.4c76c50-0ubuntu6","19.2.0~git20240301.4c76c50-0ubuntu6.1","19.2.0-0ubuntu0.24.04.1","19.2.0-0ubuntu0.24.04.2","19.2.1-0ubuntu0.24.04.2","19.2.3-0ubuntu0.24.04.1","19.2.3-0ubuntu0.24.04.2","19.2.3-0ubuntu0.24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.2.0-0ubuntu2.1"}]}],"versions":["19.2.1-0ubuntu3","19.2.3-0ubuntu2","19.2.3-0ubuntu3","19.2.3-0ubuntu4","20.2.0-0ubuntu1","20.2.0-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.13-0ubuntu0.18.04.11+esm3"}]}],"versions":["12.2.0-0ubuntu1","12.2.1-0ubuntu1","12.2.2-0ubuntu1","12.2.2-0ubuntu2","12.2.4-0ubuntu1","12.2.4-0ubuntu1.1","12.2.7-0ubuntu0.18.04.1","12.2.8-0ubuntu0.18.04.1","12.2.8-0ubuntu0.18.04.2","12.2.11-0ubuntu0.18.04.1","12.2.11-0ubuntu0.18.04.2","12.2.12-0ubuntu0.18.04.1","12.2.12-0ubuntu0.18.04.2","12.2.12-0ubuntu0.18.04.3","12.2.12-0ubuntu0.18.04.4","12.2.12-0ubuntu0.18.04.5","12.2.13-0ubuntu0.18.04.2","12.2.13-0ubuntu0.18.04.3","12.2.13-0ubuntu0.18.04.4","12.2.13-0ubuntu0.18.04.5","12.2.13-0ubuntu0.18.04.6","12.2.13-0ubuntu0.18.04.7","12.2.13-0ubuntu0.18.04.8","12.2.13-0ubuntu0.18.04.10","12.2.13-0ubuntu0.18.04.11","12.2.13-0ubuntu0.18.04.11+esm1","12.2.13-0ubuntu0.18.04.11+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.17-0ubuntu0.20.04.6+esm2"}]}],"versions":["14.2.2-0ubuntu3","14.2.2-0ubuntu4","14.2.4-0ubuntu1","14.2.4-0ubuntu2","14.2.4-0ubuntu3","15.1.0-0ubuntu2","15.1.0-0ubuntu3","15.1.1-0ubuntu1","15.2.0-0ubuntu1","15.2.0-0ubuntu2","15.2.1-0ubuntu1","15.2.1-0ubuntu2","15.2.3-0ubuntu0.20.04.1","15.2.3-0ubuntu0.20.04.2","15.2.5-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.2","15.2.8-0ubuntu0.20.04.1","15.2.11-0ubuntu0.20.04.2","15.2.12-0ubuntu0.20.04.1","15.2.13-0ubuntu0.20.04.1","15.2.13-0ubuntu0.20.04.2","15.2.14-0ubuntu0.20.04.1","15.2.14-0ubuntu0.20.04.2","15.2.16-0ubuntu0.20.04.1","15.2.17-0ubuntu0.20.04.1","15.2.17-0ubuntu0.20.04.3","15.2.17-0ubuntu0.20.04.4","15.2.17-0ubuntu0.20.04.5","15.2.17-0ubuntu0.20.04.6","15.2.17-0ubuntu0.20.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.2.9-0ubuntu0.22.04.4"}]}],"versions":["16.2.6-0ubuntu1","16.2.6-0ubuntu2","16.2.6-0ubuntu3","16.2.7-0ubuntu1","16.2.7-0ubuntu4","17.1.0-0ubuntu1","17.1.0-0ubuntu2","17.1.0-0ubuntu3","17.2.0-0ubuntu0.22.04.1","17.2.0-0ubuntu0.22.04.2","17.2.5-0ubuntu0.22.04.2","17.2.5-0ubuntu0.22.04.3","17.2.6-0ubuntu0.22.04.1","17.2.6-0ubuntu0.22.04.2","17.2.6-0ubuntu0.22.04.3","17.2.7-0ubuntu0.22.04.1","17.2.7-0ubuntu0.22.04.2","17.2.9-0ubuntu0.22.04.1","17.2.9-0ubuntu0.22.04.2","17.2.9-0ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.2.0-0ubuntu2.1"}]}],"versions":["19.2.1-0ubuntu3","19.2.3-0ubuntu2","19.2.3-0ubuntu3","19.2.3-0ubuntu4","20.2.0-0ubuntu1","20.2.0-0ubuntu2"]}],"products":[{"vendor":"ceph","product":"ceph"}],"references":[{"url":"https://github.com/ceph/ceph/security/advisories/GHSA-rmjq-ffrm-j6vj","tags":["x_refsource_CONFIRM","web","advisory","report"]},{"url":"https://github.com/ceph/ceph/commit/5837aa8e60471128dbb672b0ff6f1b1feebe08a7","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/ceph/ceph/commit/5978c866d4a0812fbb024745c4f1e79aaecd6c6a","tags":["x_refsource_MISC","web","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54330","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54330.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54330","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0389.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36147","tags":["report"]},{"url":"https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.html#upgrading-and-rotating-cephx-keys","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/19/4","tags":["web"]},{"url":"https://docs.ceph.com/en/latest/security/CVE-2025-30156/","tags":["advisory"]},{"url":"https://web.mit.edu/tlyu/papers/krb4peril-ndss04.pdf","tags":["web"]},{"url":"https://github.com/ceph/ceph/security/advisories/GHSA-rg9p-5xcp-wm8h","tags":["advisory"]},{"url":"https://docs.ceph.com/en/latest/security/CVE-2026-50152/","tags":["advisory"]},{"url":"https://docs.ceph.com/en/latest/security/CVE-2026-54330","tags":["advisory"]},{"url":"https://github.com/ceph/ceph/security/advisories/GHSA-j73r-qrgx-jvq2","tags":["advisory"]},{"url":"https://docs.ceph.com/en/latest/security/CVE-2026-39944","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:79101","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2393864","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519431","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79101.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-48795","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-48795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795","tags":["advisory"]},{"url":"https://access.redhat.com/solutions/7071748","tags":["article"]},{"url":"https://terrapin-attack.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-48916","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-48916","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48916","tags":["advisory"]},{"url":"https://github.com/ceph/ceph/pull/60624/commits/919da3696668a07c6810dfa39301950c81c2eba4","tags":["article"]},{"url":"https://github.com/ceph/ceph/security/advisories/GHSA-5g9m-mmp6-93mq","tags":["article"]},{"url":"https://tracker.ceph.com/issues/68836","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30156","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30156","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30156","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39944","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39944","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39944","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50152","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54330","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54330","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2026-54330","tags":["report"]},{"url":"https://docs.ceph.com/en/latest/security/CVE-2026-54330/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8867-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-54330","title":"Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.","status":"published","published":"2026-08-27T20:59:24.688Z","modified":"2026-09-01T03:56:17.801Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-67276","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.","status":"published","published":"2026-08-27T20:59:24Z","modified":"2026-09-01T03:56:17Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:19.285273Z"}],"nvd":[{"id":"CVE-2026-54330","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.","status":"published","published":"2026-08-28T00:18:07.683Z","modified":"2026-09-08T21:11:56.25Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-54330","title":"Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.","status":"published","published":"2026-08-27T20:59:24.688Z","modified":"2026-10-28T02:30:29.615387435Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"DEBIAN-CVE-2026-54330","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.","status":"published","published":"2026-08-28T00:18:07.683Z","modified":"2026-10-01T03:03:26.289266682Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"RHSA-2026:79101","title":"Red Hat Security Advisory: Red Hat Ceph Storage 8.1 security and bug fix updates","status":"published","published":"2026-10-10T10:22:40Z","modified":"2026-10-17T10:20:31Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-54330","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.","status":"published","published":"2026-08-28T00:18:00Z","modified":"2026-10-05T19:22:26.697922233Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-98340","title":"CVE-2026-54330 affecting package ceph for versions less than 18.2.2-13","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.","status":"published","published":"2026-08-28T00:18:07Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"BIT-ceph-2026-54330","title":"Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.","status":"published","published":"2026-09-02T14:37:35.258Z","modified":"2026-09-02T16:25:22.40896144Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"MGASA-2026-0389","title":"Updated ceph packages fix security vulnerabilities","description":"Updated ceph packages fix various security issues allowing\nauthentication bypasses to gain admin privileges on the OSD, MDS, and\nMGR services. Notice that some of the fixes require kernel support for\naes256k (introduced in kernel 7). This update will not break installs\nusing the old (and insecure) AES keys; warnings will appear to migrate\nall keys (check out \"ceph health detail\" or \"ceph status\").\n","status":"published","published":"2026-09-09T23:52:21Z","modified":"2026-09-10T00:12:25.013579669Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"USN-8867-1","title":"ceph vulnerability","description":"It was discovered that the Ceph Object Gateway (RGW) SigV4 handler did not\nreject requests carrying x-amz-* headers that were absent from the signed\nheader set. An attacker holding a presigned URL could possibly use this issue to\nattach arbitrary unsigned x-amz-* headers that RGW would honor, allowing them to escalate\ntheir privileges beyond what the URL's signer intended.","status":"published","published":"2026-10-05T11:31:11Z","modified":"2026-10-05T19:28:05.435921569Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}