CVE-2026-39944: Ceph RGW STS tokens vulnerable to CBC bit-flip privilege escalation

Summary

CVE-2026-39944 is an improper verification of a cryptographic signature in Ceph RGW’s STS session tokens.

Patches are available in Tentacle 20.2.4 and Squid 19.2.6.

Background

RGW’s STS session tokens are protected by the same unauthenticated AES-128-CBC handler as the CephX flaw in CVE-2025-30156: AES-CBC misuse in CephX facilitating authentication bypass, and share its lack of integrity protection. It has no HMAC and uses a hard-coded initialization vector, the same weakness MIT documented in Kerberos 4 in the 2004 PERILS paper. Because the ciphertext is unauthenticated, an attacker holding any valid STS token can bit-flip the acct_type and is_admin fields undetected. A forged is_admin value triggers the global is_admin() override in rgw_process_authenticated(), which bypasses all check_caps() restrictions and grants full RGW admin access.

This exploit only relies on a valid, unprivileged STS token the attacker already holds. STS must be enabled (rgw_s3_auth_use_sts = true).

CVSS breakdown

Confidentiality: High. An attacker with RGW admin access can decrypt objects across every account the instance manages.
Integrity: High. An attacker with RGW admin access can rewrite credentials and impersonate any cluster identity.
Availability: High. An attacker with RGW admin access can delete or deny stored data in the cluster.
Access Complexity: High. An attacker must bit-flip the known acct_type and is_admin fields.
Authentication: Partial. An attacker must hold a valid STS token, but does not require any initial privileges.
Gained Access: Yes. An attacker can forge credentials with a changed scope, including RGW admin access, from a single STS token.

Affected versions

All prior versions of RGW STS session token authentication are vulnerable.

Fixed versions

Tentacle 20.2.4 (and later)
Squid 19.2.6 (and later)

Recommendations

All Ceph users should upgrade immediately and follow key migration guidance in product-specific documentation.

Credits

This vulnerability was reported by Erin Shepherd of e43.eu and later independently by David Mohren and Mark Nelson of CLYSO.

Brought to you by the Ceph Foundation

The Ceph Documentation is a community resource funded and hosted by the non-profit Ceph Foundation. If you would like to support this and our other efforts, please consider joining now.