CVE-2026-54330: Ceph Object Gateway Privilege Escalation

CVE-2026-54330 Overview

CVE-2026-54330 is a signature validation flaw [CWE-347] in the Ceph Object Gateway (RGW) SigV4 handler. The handler validates only headers listed in X-Amz-SignedHeaders and ignores additional x-amz-* headers on the request. An attacker holding a presigned URL can attach arbitrary unsigned x-amz-* headers that RGW honors, granting capabilities the URL signer never authorized. AWS S3 rejects such requests, but Ceph did not. The issue affects Ceph versions prior to 20.2.4 and 19.2.6 and enables privilege escalation against object storage.

Critical Impact
Any holder of a presigned PUT URL can escalate privileges by injecting unsigned x-amz-* headers, compromising confidentiality and integrity of stored objects.

Affected Products

Ceph Object Gateway (RGW) versions prior to 19.2.6
Ceph Object Gateway (RGW) versions prior to 20.2.4
Ceph multisite deployments using the built-in REST client

Discovery Timeline

2026-08-28 - CVE-2026-54330 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-54330

Vulnerability Analysis

The Ceph Object Gateway implements Amazon S3 Signature Version 4 (SigV4) authentication for API requests. Under SigV4, clients sign a canonical request that includes a specific set of headers declared in the X-Amz-SignedHeaders parameter. AWS S3 enforces that every x-amz-* header present on the request appears in this signed set and rejects requests carrying additional unsigned x-amz-* headers.

RGW deviates from this behavior. Its get_v4_canonical_headers function processes only the headers listed in X-Amz-SignedHeaders and silently accepts any additional x-amz-* headers without verifying they were covered by the signature. Those extra headers still influence request handling.

An attacker with a valid presigned PUT URL can append headers such as x-amz-acl, x-amz-grant-full-control, or x-amz-meta-* to gain permissions the signer did not intend to delegate. The multisite REST client in Ceph itself generated such improperly signed requests, which is why the fix ships with a temporary rgw_sigv4_insecure compatibility flag.

Root Cause

The root cause is improper verification of a cryptographic signature [CWE-347]. RGW validates presence of signed headers but does not enforce completeness — the canonical header set used for validation ignores unsigned x-amz-* entries rather than rejecting the request.

Attack Vector

Exploitation requires network access and possession of a legitimately issued presigned URL. The attacker adds unsigned x-amz-* headers to a PUT request, causing RGW to apply those directives while still accepting the signature as valid.

text

// Patch excerpt: src/rgw/rgw_auth_s3.cc
 boost::optional<std::string>
-get_v4_canonical_headers(const req_info& info,
+get_v4_canonical_headers(CephContext* cct,
+                         const req_info& info,
                          const std::string_view& signedheaders,
                          const bool using_qs,
                          const bool force_boto2_compat)

Source: GitHub Ceph Commit 5837aa8

Detection Methods for CVE-2026-54330

Indicators of Compromise

RGW access logs showing PUT requests where the header set contains x-amz-* headers not listed in the request's X-Amz-SignedHeaders query parameter.
Unexpected object ACL changes (for example x-amz-acl: public-read) applied through presigned URLs.
Unexpected x-amz-grant-* headers or x-amz-meta-* overrides on uploads originating from external clients.

Detection Strategies

Parse RGW request logs and diff the set of x-amz-* headers observed against the signed header list; flag any delta.
Baseline the x-amz-* header vocabulary used by legitimate applications and alert on outliers, especially ACL-modifying headers.
Correlate presigned URL issuance events with subsequent PUT requests to identify header injection against short-lived credentials.

Monitoring Recommendations

Enable verbose RGW debug_rgw logging during and after upgrade to capture SigV4 rejection events tied to CVE-2026-54330.
Ship RGW and reverse-proxy logs to a centralized SIEM or data lake for retention and correlation with object ACL change events.
Monitor bucket policy and object ACL audit trails for grants that do not match the requesting IAM identity.

How to Mitigate CVE-2026-54330

Immediate Actions Required

Upgrade RGW to Ceph 19.2.6 or 20.2.4, which reject SigV4 requests carrying host or x-amz-* headers absent from the signed set.
For multisite clusters, set rgw_sigv4_insecure to true before upgrading, then set it back to false after all sites are on the fixed release.
Rotate any presigned URLs that may have been shared with untrusted parties and shorten default expiry windows.
Audit object ACLs and bucket policies for unexpected grants issued during the exposure window.

Patch Information

The fix is delivered in commits 5837aa8 and 5978c866. Both patches extend get_v4_canonical_headers to accept a CephContext* and reject requests where x-amz-* or host headers fall outside the signed subset. See the GitHub Security Advisory GHSA-rmjq-ffrm-j6vj for the full advisory.

Workarounds

Restrict issuance of presigned URLs to trusted internal workflows only until the patch is deployed.
Terminate S3 traffic behind a reverse proxy that strips x-amz-* headers not present in the request's X-Amz-SignedHeaders parameter.
Reduce presigned URL expiration to the minimum operationally viable duration to shrink the exploitation window.

bash

# Multisite upgrade sequence: enable compatibility, upgrade, then re-enforce
ceph config set client.rgw rgw_sigv4_insecure true
# ... perform rolling upgrade of all RGW daemons to 19.2.6 or 20.2.4 ...
ceph config set client.rgw rgw_sigv4_insecure false