Bug 2519431 (CVE-2026-39944)

Summary: CVE-2026-39944 ceph: ceph: RGW STS session tokens vulnerable to CBC bit-flip attack enabling admin privilege escalation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: amctagga, aoconnor, bniver, flucifre, gmeno, groman, mbenjamin, mhackett, security-response-team, sostapov, vereddy
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Ceph RGW's STS (Security Token Service) session token implementation. The STS tokens use the same unauthenticated AES-128-CBC encryption as CephX, which lacks message authentication and uses a hardcoded initialization vector. Because there is no integrity protection on the tokens, an attacker who holds any valid unprivileged STS token can perform a CBC bit-flip attack to modify the token contents and escalate to full RGW admin privileges. This requires only that STS is enabled (rgw_s3_auth_use_sts = true) and that the attacker has a single valid STS token. Successful exploitation grants complete control over the RGW service, including reading, writing, and deleting all objects and buckets.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-08-19   

Description OSIDB Bzimport 2026-08-19 07:59:04 UTC 
Use of a broken cryptographic algorithm vulnerability in Ceph RGW's STS session token handling. The STS tokens use the same unauthenticated AES-128-CBC handler as CephX (CVE-2025-30156) and share its lack of integrity protection. An attacker holding any valid STS token can use CBC bit-flipping to modify the token contents without detection, obtaining full RGW admin access. Unlike the CephX attack which requires access to the internal cluster network and a Ceph monitor, this attack is a self-contained modification of a token the attacker already holds, requiring only a single valid unprivileged STS token and STS to be enabled.