Quick answers
- Is CVE-2026-54330 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54330 being exploited in the wild.
- How severe is CVE-2026-54330?
- High severity, with a CVSS score of 8.1, published 28 August 2026.
- Which products and versions are affected?
- Ceph prior to 20.2.4 and 19.2.6.
- Is there a fix for CVE-2026-54330?
- A patch was published on 2026-08-17: Fix merged in Ceph development branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-54330 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-54330?
- Check whether you run Ceph at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a signature validation bypass in RGW's SigV4 handler. The root cause is that RGW only validates headers listed in the X-Amz-SignedHeaders field but ignores any additional x-amz-* or host headers present in the request, even though AWS S3 requires all such headers to be included in the signature. An attacker holding a presigned PUT URL can attach arbitrary unsigned x-amz-* headers (e.g., x-amz-storage-class, x-amz-acl) that RGW will honor without signature verification. The vulnerability affects versions prior to 20.2.4 and 19.2.6 and requires the attacker to already possess a valid presigned URL, making it a privilege escalation attack. Patches are available in versions 20.2.4, 19.2.6, and later.
Affected products
- Ceph Ceph prior to 20.2.4 and 19.2.6
Timeline
- 2026-08-28: disclosed
- 2026-08-17: patched: Fix merged in Ceph development branches