CVE-2026-54330: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-54330 is an improper cryptographic signature verification vulnerability (CWE-347) in Ceph RGW's SigV4 signature handler that allows privilege escalation via unauthorized attachment of unsigned x-amz-* headers to presigned S3 PUT URLs. It affects Ceph RGW versions prior to 19.2.6 and 20.2.4. The vulnerability was published on August 19, 2026, with patched versions released the same day. It carries a CVSS v3.1 base score of 8.2 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is that Ceph RGW's SigV4 handler only validates headers explicitly listed in the X-Amz-SignedHeaders field of a request, but does not reject requests that carry additional unsigned x-amz-* headers — a behavior that violates the AWS S3 specification, which mandates that all x-amz-* headers must be signed and that requests with unsigned headers must be rejected (CWE-347: Improper Verification of Cryptographic Signature). An attacker who possesses a valid presigned PUT URL (requiring only low-level authenticated access) can craft an HTTP request appending arbitrary unsigned x-amz-* headers (e.g., x-amz-acl, x-amz-copy-source, or server-side encryption headers) that RGW will honor without signature validation. This allows the attacker to exercise capabilities beyond what the original URL signer authorized, such as changing object ACLs or triggering server-side operations (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows an authenticated attacker holding only a presigned PUT URL to escalate privileges beyond what the original signer intended, enabling unauthorized access to and modification of S3 objects stored in Ceph RGW. The scope change (S:C in CVSS) indicates that the impact extends beyond the directly vulnerable component, with high confidentiality and integrity impacts — meaning an attacker could read sensitive object data and tamper with or overwrite S3 objects. Availability is not directly impacted, but data integrity and confidentiality risks are significant in multi-tenant or shared storage environments (GitHub Advisory, Red Hat Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat Advisory). Exploitation requires the attacker to already possess a valid presigned PUT URL, which limits the attack surface to authenticated users or those who have obtained such a URL through other means. The vulnerability has been detected by Nessus (plugin ID 338299) and is classified as an authorization bypass attack type. No threat actor attribution or CISA KEV catalog listing has been reported at this time.

1. Obtain a presigned PUT URL: Acquire a valid Ceph RGW presigned PUT URL for an S3 object — this may be obtained legitimately (e.g., as a low-privileged user) or through social engineering/phishing.
2. Identify target headers: Determine which unsigned x-amz-* headers would grant elevated capabilities, such as x-amz-acl (to change object permissions), x-amz-copy-source (to trigger server-side copy), or x-amz-server-side-encryption headers.
3. Craft malicious request: Construct an HTTP PUT request using the presigned URL and append the desired unsigned x-amz-* headers that are NOT listed in the X-Amz-SignedHeaders field of the original presigned URL.
4. Submit request to RGW: Send the crafted request to the Ceph RGW endpoint. Because RGW only validates headers listed in X-Amz-SignedHeaders and does not reject additional unsigned x-amz-* headers, it will process and honor the injected headers.
5. Achieve privilege escalation: RGW applies the unauthorized headers, granting the attacker capabilities beyond what the original signer authorized — such as modifying object ACLs, accessing restricted objects, or triggering privileged server-side operations (Red Hat Bugzilla, GitHub Advisory).

• Network: HTTP PUT requests to Ceph RGW S3 endpoints that include x-amz-* headers not listed in the X-Amz-SignedHeaders query parameter of the presigned URL.
• Logs: Ceph RGW access logs showing PUT requests with presigned URLs accompanied by additional x-amz-* headers (e.g., x-amz-acl, x-amz-copy-source) that were not part of the original signed header set; unexpected ACL changes or object modifications logged in RGW audit logs.
• Behavioral: Unexpected changes to S3 object permissions or metadata; objects being accessed or modified by users whose presigned URLs should not have granted such capabilities; unusual server-side copy or encryption operations triggered via presigned PUT URLs.

Ceph has released patched versions 19.2.6 and 20.2.4 that enforce proper SigV4 signature validation by rejecting requests carrying unsigned x-amz-* headers not listed in X-Amz-SignedHeaders. Organizations should upgrade to these versions immediately (GitHub Advisory). As interim workarounds until patching is complete: restrict distribution of presigned PUT URLs to trusted parties only, monitor S3 request logs for suspicious or unexpected x-amz-* headers, and consider implementing additional header validation at the reverse proxy or load balancer layer (Red Hat Advisory).

The vulnerability was disclosed via the oss-security mailing list and an OpenStack Security Note (OSSN-0108) was published, indicating awareness within the OpenStack/Ceph community (oss-sec, OpenStack OSSN). Red Hat filed a high-severity bug report and coordinated the disclosure, reflecting the significance of the flaw for enterprise Ceph deployments. The credit for discovery was attributed to researcher "Greenpepper15" per the GitHub Security Advisory (GitHub Advisory).