CVE-2026-54330

CVE-2026-54330 affects the Ceph Object Gateway (RGW) SigV4 verifier in versions prior to 20.2.4 and 19.2.6 . The handler fails to reject requests carrying x-amz-* headers that are absent from the signed header set, unlike AWS S3 which rejects such unsigned headers. An attacker holding a presigned...

CVE-2026-54330 Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CVE-2026-54330

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

PT-2026-82771

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CVE-2026-79787 Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

PT-2026-81482

Name of the Vulnerable Software and Affected Versions Alluxio affected versions not specified Description The S3 REST proxy fails to verify AWS Signature Version 4 signatures when using the default configuration. This allows unauthenticated attackers to spoof user identity by extracting usernames...

Fedora 44 : ceph (2026-7de7d03796)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7de7d03796 advisory. Ceph 20.2.4 GA CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC...

Fedora 43 : ceph (2026-ebffec502b)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ebffec502b advisory. Ceph 19.2.6 GA CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: verticadb-operator, gitlab-runner, lvm-driver, sealed-secrets, spire-server, git-lfs, crossplane-provider-aws-sns, fuse-overlayfs-snapshotter, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, traefik, sftpgo-plugin-kms, bank-vaults, boring-registry,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: mage, sbom-convert, gke-gcloud-auth-plugin, secrets-store-csi-driver-provider-gcp, dgraph, secrets-store-csi-driver, ctop, fixuid, nri-prometheus, pguser, x509-certificate-exporter, flannel, http-echo, velero-plugin-for-microsoft-azure, atlantis, nodetaint,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: sealed-secrets, harbor, envconsul, ko, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, mage, speedtest-go, sbom-convert, src-fingerprint, boring-registry, protoc-gen-go-grpc, gke-gcloud-auth-plugin, terraform, step-kms-plugin,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: sealed-secrets, harbor, envconsul, ko, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, mage, speedtest-go, sbom-convert, src-fingerprint, boring-registry, gke-gcloud-auth-plugin, terraform, step-kms-plugin, neuvector-sigstore-interface, kind,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: sealed-secrets, harbor, envconsul, ko, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, mage, speedtest-go, sbom-convert, src-fingerprint, boring-registry, protoc-gen-go-grpc, gke-gcloud-auth-plugin, terraform, step-kms-plugin,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: sealed-secrets, harbor, envconsul, ko, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, mage, speedtest-go, sbom-convert, src-fingerprint, boring-registry, protoc-gen-go-grpc, gke-gcloud-auth-plugin, terraform, step-kms-plugin,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: sealed-secrets, harbor, envconsul, ko, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, mage, speedtest-go, sbom-convert, src-fingerprint, boring-registry, protoc-gen-go-grpc, terraform, step-kms-plugin, neuvector-sigstore-interface, kind,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: sealed-secrets, harbor, envconsul, ko, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, mage, speedtest-go, sbom-convert, src-fingerprint, boring-registry, protoc-gen-go-grpc, gke-gcloud-auth-plugin, terraform, step-kms-plugin,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: sealed-secrets, harbor, envconsul, ko, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, mage, speedtest-go, sbom-convert, src-fingerprint, boring-registry, protoc-gen-go-grpc, gke-gcloud-auth-plugin, terraform, step-kms-plugin,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: sealed-secrets, harbor, envconsul, ko, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, mage, speedtest-go, sbom-convert, src-fingerprint, boring-registry, protoc-gen-go-grpc, gke-gcloud-auth-plugin, terraform, step-kms-plugin,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: sealed-secrets, harbor, envconsul, ko, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, mage, speedtest-go, sbom-convert, src-fingerprint, boring-registry, protoc-gen-go-grpc, gke-gcloud-auth-plugin, terraform, step-kms-plugin,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: sealed-secrets, harbor, envconsul, ko, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, mage, speedtest-go, sbom-convert, src-fingerprint, boring-registry, protoc-gen-go-grpc, gke-gcloud-auth-plugin, terraform, step-kms-plugin,...