CVE-2026-54330

Ceph Object Gateway (RGW) accepts requests carrying x-amz-* headers that are not part of the SigV4 signature: it validates only the headers listed in X-Amz-SignedHeaders and silently honors any additional ones, whereas AWS S3 requires every x-amz-* header to be signed (CWE-347, improper verification of cryptographic signature). The flaw is triggered by sending a request to the RGW S3 endpoint using a presigned URL while appending arbitrary unsigned x-amz-* headers, which take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker holding the URL gains capabilities beyond what the URL's signer intended, effectively escalating their privileges, with potential for high confidentiality and integrity impact but no availability impact (CVSS 3.1: 8.1). Organizations running the Ceph Object Gateway on Ceph releases prior to 20.2.4 (20.x series) or prior to 19.2.6 (19.x series) are affected, particularly deployments that share presigned URLs with third parties. No public proof of concept is known, the issue is not in CISA KEV, and EPSS estimates only about a 0.2% probability of exploitation within 30 days.

What to do: Upgrade Ceph to 20.2.4 (20.x) or 19.2.6 (19.x), which make RGW reject requests whose x-amz-* headers fall outside the signed header set. Until patched, limit distribution of presigned URLs to untrusted parties and audit RGW access logs for requests containing x-amz-* headers not listed in X-Amz-SignedHeaders. If misuse is suspected, review what capabilities presigned URLs grant and rotate signing credentials.