Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Ceph Object Gateway can let attackers raise privileges

published 1 month ago
Summary

The Ceph storage system’s Object Gateway does not properly check certain request headers when a pre‑signed URL is used. This means someone with such a URL could add extra instructions that the server accepts, giving them more access than intended. Update to the latest Ceph release or apply the vendor’s patch to close the gap.

What to do
  • Update canonical ceph to version 12.2.13-0ubuntu0.18.04.11+esm3.
  • Update canonical ceph to version 15.2.17-0ubuntu0.20.04.6+esm2.
  • Update canonical ceph to version 17.2.9-0ubuntu0.22.04.4.
  • Update canonical ceph to version 20.2.0-0ubuntu2.1.
Affected software
Ecosystem VendorProductAffected versions
Ubuntu:Pro:18.04:LTS canonical ceph < 12.2.13-0ubuntu0.18.04.11+esm3
Fix: upgrade to 12.2.13-0ubuntu0.18.04.11+esm3
Ubuntu:Pro:20.04:LTS canonical ceph < 15.2.17-0ubuntu0.20.04.6+esm2
Fix: upgrade to 15.2.17-0ubuntu0.20.04.6+esm2
Ubuntu:22.04:LTS canonical ceph < 17.2.9-0ubuntu0.22.04.4
Fix: upgrade to 17.2.9-0ubuntu0.22.04.4
Ubuntu:26.04:LTS canonical ceph < 20.2.0-0ubuntu2.1
Fix: upgrade to 20.2.0-0ubuntu2.1
Original advisory text
ceph vulnerability
It was discovered that the Ceph Object Gateway (RGW) SigV4 handler did not
reject requests carrying x-amz-* headers that were absent from the signed
header set. An attacker holding a presigned URL could possibly use this issue to
attach arbitrary unsigned x-amz-* headers that RGW would honor, allowing them to escalate
their privileges beyond what the URL's signer intended.
References
Timeline
Published5 Oct 2026
Updated5 Oct 2026
First seen5 Oct 2026
Sources
USN-8867-1 · OSV
Track software like this
Free during beta