CVE-2026-39944: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-39944 is a CBC bit-flip privilege escalation vulnerability in Ceph RGW's STS (Security Token Service) session token implementation. An attacker holding any valid unprivileged STS token can tamper with the token's acct_type, perm_type, and is_admin fields to forge full RGW admin credentials. Affected versions are Ceph < 19.2.6 and < 20.2.4; patched versions are 19.2.6 and 20.2.4. It carries a CVSS v3.1 base score of 8.5 (High) (GitHub Advisory, Red Hat Bugzilla). The CVE was published on August 19, 2026 (Red Hat CVE).

The root cause is classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). Ceph RGW's STS session tokens are encrypted using the same unauthenticated AES-128-CBC handler as CephX (CVE-2025-30156), which provides no message authentication and uses a hardcoded initialization vector. Because the ciphertext is unauthenticated, an attacker can perform a CBC bit-flip attack on the acct_type, perm_type, and is_admin fields of a token they already possess, altering the underlying plaintext values without detection. A forged is_admin value triggers the global is_admin() override in rgw_process_authenticated(), bypassing all check_caps() restrictions and granting full RGW admin access. Unlike the related CephX attack (CVE-2025-30156), this attack requires no oracle and no network observation — only a single valid STS token and STS being enabled (rgw_s3_auth_use_sts = true) (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation grants an attacker complete control over the Ceph RGW service, including the ability to read, write, and delete all objects and buckets across the entire storage cluster. The scope change (S:C in CVSS) reflects that a low-privileged user can escalate to full administrative access, impacting confidentiality, integrity, and availability at the highest level. Any data stored in the RGW-managed object store is at risk of exfiltration, corruption, or destruction, and the attacker could further abuse admin access to create or modify credentials for persistent access (GitHub Advisory, Red Hat CVE).

As of the disclosure date (August 19, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Red Hat CVE). The attack complexity is rated High (AC:H) due to the need to perform precise CBC bit-flipping on specific token fields, but the attack is self-contained and requires no external oracle. The vulnerability is not listed in the CISA KEV catalog at this time. EPSS score data is not yet available for this CVE.

1. Obtain a valid STS token: Authenticate to the Ceph RGW S3 endpoint using any valid low-privileged AWS STS credentials (e.g., via AssumeRole) to receive a session token.
2. Decode the token: Base64-decode the STS session token to extract the AES-128-CBC ciphertext.
3. Identify target fields: Analyze the token structure to locate the byte offsets corresponding to the acct_type, perm_type, and is_admin fields within the encrypted payload.
4. Perform CBC bit-flip: XOR specific bytes in the ciphertext at the identified offsets to flip the is_admin field value to true (or equivalent admin indicator) without needing the encryption key, exploiting the lack of message authentication.
5. Submit forged token: Send the modified token to the RGW S3 endpoint in an API request; rgw_process_authenticated() evaluates the forged is_admin value and grants full admin access, bypassing all check_caps() restrictions.
6. Achieve full RGW admin control: Use the escalated session to read, write, delete, or enumerate all objects and buckets, or create new privileged credentials for persistence (GitHub Advisory, Red Hat Bugzilla).

• Network: Unexpected S3 API requests to the RGW endpoint using STS session tokens that perform admin-level operations (e.g., listing all buckets, deleting buckets) from accounts not normally granted admin privileges.
• Logs: RGW access logs showing STS-authenticated requests with is_admin privilege performing operations inconsistent with the token's original role or policy; repeated STS token usage from the same source IP with varying token values.
• Behavioral: Low-privileged IAM/STS users suddenly performing bucket-level administrative operations (e.g., DeleteBucket, PutBucketPolicy, ListAllMyBuckets) that exceed their assigned permissions.
• File System: Unexpected changes to bucket ACLs, policies, or object ownership across the RGW cluster following STS-authenticated sessions.

Ceph has released patched versions 19.2.6 and 20.2.4 that address this vulnerability; upgrading to these versions is the recommended remediation (GitHub Advisory). As an immediate workaround, disable STS if it is not required by setting rgw_s3_auth_use_sts = false in the Ceph configuration (Red Hat CVE). Additionally, implement network segmentation to restrict access to RGW admin endpoints and monitor for anomalous token-based administrative activity as a compensating control.

The vulnerability was disclosed via the oss-security mailing list and an OpenStack Security Note (OSSN-0108) was published, indicating cross-project awareness given RGW's use in OpenStack Swift-compatible deployments (oss-sec, OpenStack OSSN). The GitHub Security Advisory credits researchers markhpc, Greenpepper15, mctaggatart, and erincandescent for reporting and coordinating the disclosure (GitHub Advisory). Tenable added detection support via Nessus plugin 338274 shortly after disclosure (Tenable).