Skip to content
OpenAdvisories
High USN-8867-1 1 CVE

ceph vulnerability

Published Oct 5, 2026 · Updated Oct 5, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the Ceph Object Gateway (RGW) SigV4 handler did not
reject requests carrying x-amz-* headers that were absent from the signed
header set. An attacker holding a presigned URL could possibly use this issue to
attach arbitrary unsigned x-amz-* headers that RGW would honor, allowing them to escalate
their privileges beyond what the URL's signer intended.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS ceph 17.2.9-0ubuntu0.22.04.4
Ubuntu · 26.04 LTS 26.04:LTS ceph 20.2.0-0ubuntu2.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ceph 12.2.13-0ubuntu0.18.04.11+esm3
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS ceph 15.2.17-0ubuntu0.20.04.6+esm2

Vulnerabilities 1

  • High 8.1
    CVE-2026-54330

    Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

    Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed heade…

    ceph ceph ceph ceph Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-54330