Arbitrary Header Injection in Ceph Object Gateway by The Ceph Project
CVE-2026-54330
8.1HIGH
What is CVE-2026-54330?
The Ceph Object Gateway (RGW) has a vulnerability that allows attackers holding presigned URLs to include arbitrary unsigned x-amz-* headers. This oversight occurs because RGW only validates headers specified in the X-Amz-SignedHeaders and does not reject additional unsigned x-amz-* headers. As a result, attackers can leverage this flaw to escalate privileges and gain unauthorized capabilities beyond what the original presigned URL intended, posing significant security risks. The issue has been resolved in updates 20.2.4 and 19.2.6.
Affected Version(s)
ceph >= 19.0.0, < 19.2.6 < 19.0.0, 19.2.6
ceph >= 20.0.0, < 20.2.4 < 20.0.0, 20.2.4