CVE-2026-39944: Ceph: CephX AES Authentication error
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway (RGW) protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid STS token to tamper with it undetected and escalate to full RGW administrative access. Because the ciphertext is unauthenticated, the attacker can perform a CBC bit-flip on the accttype, permtype, and isadmin fields of their own token, and a forged isadmin value triggers a global administrative override that bypasses all capability checks. The attack is reachable remotely over the RGW S3 endpoint and is a self-contained modification of a token the attacker already possesses, requiring no encryption oracle and no network observation. It requires only a single valid STS token, which need not carry any elevated privileges, with STS enabled. This issue is fixed in versions 20.2.4 and 19.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ceph RADOS Gateway (RGW)to a version that resolves this vulnerability.Fixed in 20.2.4 - Upgrade
Upgrade
Ceph RADOS Gateway (RGW)to a version that resolves this vulnerability.Fixed in 19.2.6
Event History
Frequently Asked Questions
Who is exposed to this issue?
Ceph deployments running an affected version with RADOS Gateway STS enabled are exposed through the RGW S3 endpoint. An attacker must possess any valid STS session token; the token does not need elevated privileges.
Does exploitation require intercepting traffic or access to an encryption service?
No. The attack consists of modifying a valid STS token held by the attacker using CBC bit flips. It requires no network observation and no encryption oracle.
What access can an attacker gain?
An attacker can alter token fields including is_admin. A forged is_admin value triggers a global administrative override that bypasses capability checks, resulting in full RGW administrative access.
What should be prioritized for remediation?
Upgrade Ceph to 20.2.4 or 19.2.6. If an immediate upgrade is not possible, the provided information identifies STS-enabled RGW deployments as the affected condition.