CVE-2026-54330: SigV4 verifier error allows attachment of arbitrary x-amz-* headers resulting in privilege escalation

Summary

CVE-2026-54330 is an improper verification of a cryptographic signature in Ceph RGW’s SigV4 handler. Anyone holding a presigned PUT URL can attach arbitrary x-amz-* headers, which RGW then applies, granting more capability than the signer intended.

Patches are available in Tentacle 20.2.4 and Squid 19.2.6.

Background

AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects any request that carries an unsigned one. RGW does not. It verifies only the headers listed in X-Amz-SignedHeaders and ignores the rest, so unsigned x-amz-* headers bypass the signature check. An attacker who holds nothing but a presigned PUT URL can therefore inject headers the signer never authorized, escalating the URL’s privileges and producing high impact to confidentiality and integrity.

CVE-2026-54330 is an improper verification of a cryptographic signature in Ceph RGW’s SigV4 handler. Anyone holding a presigned PUT URL can attach arbitrary x-amz-* headers, which RGW then applies, granting more capability than the signer intended.

CVSS breakdown

Confidentiality: High. An attacker can use x-amz-copy-source and a public-read ACL to read every object that the signer’s identity can access.
Integrity: High. An attacker can write and alter the ACL of the presigned URL’s target object.
Availability: None.
Access Complexity: High. An attacker must attach chosen, but arbitrary, x-amz* headers to grant additional capacity beyond what the signer intended.
Authentication: Partial. An attacker needs a presigned URL.
Gained Access: Yes. An attacker can escalate privileges to what the signing account is authorized for, going beyond the initial verifier.

Affected versions

All prior versions of Ceph RGW SigV4 improperly verify cryptographic signatures.

Fixed versions

Tentacle 20.2.4 (and later)
Squid 19.2.6 (and later)

Fix Details

Patched RGW now checks any new x-amz-* headers not included in the signature are present in the SigV4 request. If this is the case then the request is rejected.

Recommendations

All Ceph users who use the pre-signed URL feature should upgrade to a patched version at their earliest convenience. We do not recommend the usage of this feature under any circumstances if the update is not applied.

Critical Upgrade Steps

RGW will now reject Sigv4 requests with host and x-amz- headers not included in the signed subset. Unfortunately, the REST client used in multisite was generating such improperly signed requests.

If you are running multisite, you must set the rgw_sigv4_insecure option to true before you begin to upgrade. After all clusters are upgraded, set the option to false again.

Credits

This vulnerability was reported by David Mohren and Mark Nelson of CLYSO.

Brought to you by the Ceph Foundation

The Ceph Documentation is a community resource funded and hosted by the non-profit Ceph Foundation. If you would like to support this and our other efforts, please consider joining now.