CVE-2026-39944 Overview
Ceph is an open-source distributed storage platform that provides object, block, and file storage. The RADOS Gateway (RGW) component contains a cryptographic weakness in how it protects Security Token Service (STS) session tokens. Versions prior to 20.2.4 and 19.2.6 encrypt STS tokens with AES-128-CBC but omit message authentication. An attacker holding any valid STS token can tamper with it undetected and escalate to full RGW administrative access. The flaw is remotely reachable over the RGW S3 endpoint. Ceph maintainers fixed the issue in versions 20.2.4 and 19.2.6.
Critical Impact
An authenticated user with any valid STS token can forge administrative privileges through a CBC bit-flip attack, gaining a global admin override that bypasses all capability checks in RGW.
Affected Products
- Ceph RADOS Gateway (RGW) versions prior to 19.2.6 (Squid release line)
- Ceph RADOS Gateway (RGW) versions prior to 20.2.4 (Tentacle release line)
- Any Ceph deployment with STS enabled on the S3 endpoint
Discovery Timeline
- 2026-08-28 - CVE-2026-39944 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-39944
Vulnerability Analysis
The vulnerability is a broken cryptography flaw categorized under [CWE-327]. RGW encrypts STS session tokens using AES-128-CBC without applying a Message Authentication Code (MAC) such as HMAC or switching to an authenticated cipher mode like AES-GCM. Because the ciphertext carries no integrity guarantee, RGW accepts modified tokens as valid and decrypts them into attacker-controlled plaintext.
The token structure includes the fields acct_type, perm_type, and is_admin. When the is_admin flag decodes to true, RGW triggers a global administrative override that skips all capability checks. This gives the attacker full control over RGW-managed data and configuration.
Exploitation is self-contained. The attacker does not need an encryption oracle, network observation of other users, or elevated STS scopes. A single low-privilege STS token is sufficient.
Root Cause
The root cause is the use of an unauthenticated block cipher mode for tokens that carry authorization state. CBC mode is malleable: predictable bit flips in a preceding ciphertext block cause predictable bit flips in the corresponding plaintext block of the next block. Without a MAC, the server cannot detect these modifications before parsing the plaintext fields.
Attack Vector
An attacker first obtains any valid STS token through normal RGW STS calls. The token need carry no elevated privileges. The attacker then locates the ciphertext offsets that map to acct_type, perm_type, and is_admin. By XOR-manipulating the prior ciphertext block, the attacker flips the target plaintext bits, including setting is_admin to true. The tampered token is then presented to the RGW S3 endpoint, which decrypts it, honors the forged administrative flag, and grants global override privileges.
Refer to the GitHub Security Advisory GHSA-j73r-qrgx-jvq2 for the maintainer analysis and affected token fields.
Detection Methods for CVE-2026-39944
Indicators of Compromise
- STS session tokens whose decrypted is_admin field is true but were issued to accounts that never held admin capabilities.
- RGW audit log entries showing administrative operations performed by identities not present in the RGW admin user list.
- Unusual bucket policy changes, user creation, or key rotation actions correlated with recently issued STS tokens.
Detection Strategies
- Correlate STS token issuance events with subsequent administrative RGW operations from the same session token identifier.
- Alert on any RGW request that invokes the global admin override path while originating from a session token rather than a static admin credential.
- Compare the claimed principal in STS tokens against the RGW user database to catch mismatched or escalated identities.
Monitoring Recommendations
- Enable and centrally ingest RGW access logs and audit logs, focusing on admin API paths and STS AssumeRole activity.
- Monitor for spikes in failed or malformed token decryptions, which may indicate bit-flip probing.
- Baseline expected administrative actors and alert on deviations, particularly outside change windows.
How to Mitigate CVE-2026-39944
Immediate Actions Required
- Upgrade Ceph RGW to version 19.2.6 or 20.2.4 as soon as possible using the vendor-supplied packages.
- If upgrade is not immediately feasible, disable STS on RGW to remove the attack surface.
- Rotate any long-lived credentials used to obtain STS tokens and invalidate outstanding sessions after patching.
Patch Information
The Ceph maintainers fixed the flaw in Ceph v19.2.6 and Ceph v20.2.4. The fix replaces the unauthenticated AES-128-CBC handler with an authenticated construction so that any token tampering is detected before authorization fields are parsed.
Workarounds
- Disable STS in the RGW configuration until the upgrade is applied.
- Restrict network access to the RGW S3 endpoint so only trusted clients can request or present STS tokens.
- Tightly scope IAM policies that allow sts:AssumeRole and sts:GetSessionToken to limit which principals can obtain a valid STS token.
# Example: disable STS on RGW as a temporary workaround
ceph config set client.rgw rgw_sts_key ""
ceph config set client.rgw rgw_s3_auth_use_sts false
systemctl restart ceph-radosgw.target
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
