RADOS Gateway Vulnerability in Ceph Distributed Storage Platform

CVE-2026-39944

What is CVE-2026-39944?

In the affected versions of the Ceph RADOS Gateway, session tokens are protected by an AES-128-CBC handler that lacks message authentication. This vulnerability allows attackers with a valid STS token to tamper with their session token undetected, enabling them to escalate privileges to gain full administrative access over the RGW. Specifically, attackers can perform a CBC bit-flip manipulation on certain fields of their own token, leading to unauthorized global administrative access by bypassing capability checks. Importantly, the attack can be executed remotely via the RGW S3 endpoint without needing a sophisticated setup, as it relies solely on the modification of a token already in the attacker's possession. This issue is resolved in the subsequent releases of Ceph.

References