Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS : Ceph vulnerability (USN-8867-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8867-1 advisory. It was discovered that the Ceph Object Gateway RGW SigV4 handler did not reject requests carrying x-amz- headers that were...

USN-8867-1: Ceph vulnerability

It was discovered that the Ceph Object Gateway RGW SigV4 handler did not reject requests carrying x-amz- headers that were absent from the signed header set. An attacker holding a presigned URL could possibly use this issue to attach arbitrary unsigned x-amz- headers that RGW would honor, allowin...

BIT-CEPH-2026-54330 Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

AZL-98340 CVE-2026-54330 affecting package ceph for versions less than 18.2.2-13

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CVE-2026-54330: Improper Verification of Cryptographic Signature

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CVE-2026-54330

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...