Bug 2519428 (CVE-2026-54330)

Summary:	CVE-2026-54330 ceph: ceph: RGW SigV4 verifier allows attachment of arbitrary unsigned x-amz-* headers leading to privilege escalation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amctagga, aoconnor, bniver, flucifre, gmeno, groman, mbenjamin, mhackett, security-response-team, sostapov, vereddy
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Ceph RGW's SigV4 signature verification handler. When processing S3 requests, RGW verifies only the headers explicitly listed in the X-Amz-SignedHeaders field but does not reject requests that carry additional unsigned x-amz-* headers. This diverges from the AWS S3 specification, which requires all x-amz-* headers to be signed. As a result, anyone holding a presigned PUT URL can attach arbitrary unsigned x-amz-* headers that RGW will honor, effectively escalating their privileges beyond what the original URL signer authorized. This can lead to unauthorized access to and modification of S3 objects.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-08-19

Description OSIDB Bzimport 2026-08-19 07:56:58 UTC

Improper verification of cryptographic signature vulnerability in Ceph RGW's SigV4 handler. The flaw is caused by RGW only verifying the validity of headers listed in X-Amz-SignedHeaders without checking whether additional unsigned x-amz-* headers are present on the request. AWS S3 requires every x-amz-* header to be signed and rejects requests carrying unsigned headers, but RGW does not enforce this check. An attacker holding only a presigned PUT URL can attach arbitrary x-amz-* headers that RGW applies, granting more capabilities than the original signer intended, resulting in privilege escalation.