# CVE-2026-54330: Ceph Object Gateway SigV4 signature bypass via unsigned headers

Source: https://junglewise.ai/threats/cve-2026-54330-ceph-object-gateway-sigv4-signature-bypass-via-unsigned-headers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54330 · Severity: high · CVSS 8.1 · Published 2026-08-28

Ceph Object Gateway (RGW) is a distributed storage service compatible with AWS S3. The service fails to validate x-amz-* headers on digitally signed requests, allowing attackers with a valid presigned URL to inject additional unsigned headers and gain elevated permissions. This breaks a core security property of presigned URLs, which should limit access to specific operations and capabilities intended by the URL signer.

Technologies: [Ceph](https://junglewise.ai/threats/technologies/ceph). Vendors: [Ceph](https://junglewise.ai/threats/vendors/ceph).

## Quick answers

**Is CVE-2026-54330 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54330 being exploited in the wild.

**How severe is CVE-2026-54330?** High severity, with a CVSS score of 8.1, published 28 August 2026.

**Which products and versions are affected?** Ceph prior to 20.2.4 and 19.2.6.

**Is there a fix for CVE-2026-54330?** A patch was published on 2026-08-17: Fix merged in Ceph development branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54330 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-54330?** Check whether you run Ceph at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a signature validation bypass in RGW's SigV4 handler. The root cause is that RGW only validates headers listed in the X-Amz-SignedHeaders field but ignores any additional x-amz-* or host headers present in the request, even though AWS S3 requires all such headers to be included in the signature. An attacker holding a presigned PUT URL can attach arbitrary unsigned x-amz-* headers (e.g., x-amz-storage-class, x-amz-acl) that RGW will honor without signature verification. The vulnerability affects versions prior to 20.2.4 and 19.2.6 and requires the attacker to already possess a valid presigned URL, making it a privilege escalation attack. Patches are available in versions 20.2.4, 19.2.6, and later.

## Affected products

- Ceph Ceph prior to 20.2.4 and 19.2.6

## Timeline

- 2026-08-28: disclosed
- 2026-08-17: patched: Fix merged in Ceph development branches

## References

- [https://github.com/ceph/ceph/commit/5837aa8e60471128dbb672b0ff6f1b1feebe08a7](https://github.com/ceph/ceph/commit/5837aa8e60471128dbb672b0ff6f1b1feebe08a7)
- [https://github.com/ceph/ceph/commit/5978c866d4a0812fbb024745c4f1e79aaecd6c6a](https://github.com/ceph/ceph/commit/5978c866d4a0812fbb024745c4f1e79aaecd6c6a)

## Related threats

- [Ceph authorization bypass in config-key store](https://junglewise.ai/threats/cve-2026-50152-ceph-authorization-bypass-in-config-key-store)
- [Ceph RADOS Gateway STS token forgery via unauthenticated CBC mode](https://junglewise.ai/threats/cve-2026-39944-ceph-rados-gateway-sts-token-forgery-via-unauthenticated-cbc-mode)
- [Ceph CephX authentication credential forgery via unauthenticated encryption](https://junglewise.ai/threats/cve-2025-30156-ceph-cephx-authentication-credential-forgery-via-unauthenticated)