DEBIAN-CVE-2026-54330

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-54330
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-54330.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-54330
Upstream
Published
2026-08-28T00:18:07Z
Modified
2026-09-09T08:47:25Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.

References

Affected packages

Debian:12 / ceph

Package

Name
ceph
Purl
pkg:deb/debian/ceph?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

16.*
16.2.11+ds-2
16.2.11+ds-3
16.2.11+ds-4
16.2.11+ds-5
16.2.11+ds-5.1
16.2.15+ds-0+deb12u1
16.2.15+ds-0+deb12u2
18.*
18.2.0+ds-1
18.2.0+ds-2
18.2.0+ds-3
18.2.0+ds-4
18.2.0+ds-5
18.2.0+ds-6
18.2.0+ds-7
18.2.0+ds-8
18.2.1+ds-1
18.2.1+ds-2
18.2.1+ds-3
18.2.1+ds-4
18.2.1+ds-5
18.2.1+ds-6
18.2.1+ds-7
18.2.1+ds-8
18.2.1+ds-9
18.2.3+ds-1
18.2.3+ds-2
18.2.3+ds-3
18.2.3+ds-3+loong64
18.2.4+ds-1
18.2.4+ds-2
18.2.4+ds-3
18.2.4+ds-4
18.2.4+ds-5
18.2.4+ds-6
18.2.4+ds-7
18.2.4+ds-8
18.2.4+ds-9
18.2.4+ds-10
18.2.4+ds-11
18.2.4+ds-12
18.2.4+ds-13
18.2.6-1
18.2.7-1
18.2.7-2
18.2.7+ds-1
18.2.7+ds-1.1
18.2.8+ds-1
18.2.8+ds-2
18.2.8+ds-2.1
20.*
20.2.2+ds-1
20.2.2+ds-2
20.2.2+ds-3
20.2.2+ds-4
20.2.2+ds-5
20.2.2+ds-6
20.2.2+ds-7
20.2.2+ds-8
20.2.2+ds-9
20.2.2+ds-10
20.2.2+ds-11
20.2.2+ds-12
20.2.2+ds-13
20.2.4+ds-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-54330.json"

Debian:13 / ceph

Package

Name
ceph
Purl
pkg:deb/debian/ceph?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

18.*
18.2.7+ds-1
18.2.7+ds-1+deb13u1
18.2.7+ds-1.1
18.2.8+ds-1
18.2.8+ds-2
18.2.8+ds-2.1
20.*
20.2.2+ds-1
20.2.2+ds-2
20.2.2+ds-3
20.2.2+ds-4
20.2.2+ds-5
20.2.2+ds-6
20.2.2+ds-7
20.2.2+ds-8
20.2.2+ds-9
20.2.2+ds-10
20.2.2+ds-11
20.2.2+ds-12
20.2.2+ds-13
20.2.4+ds-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-54330.json"

Debian:14 / ceph

Package

Name
ceph
Purl
pkg:deb/debian/ceph?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
20.2.4+ds-1

Affected versions

18.*
18.2.7+ds-1
18.2.7+ds-1.1
18.2.8+ds-1
18.2.8+ds-2
18.2.8+ds-2.1
20.*
20.2.2+ds-1
20.2.2+ds-2
20.2.2+ds-3
20.2.2+ds-4
20.2.2+ds-5
20.2.2+ds-6
20.2.2+ds-7
20.2.2+ds-8
20.2.2+ds-9
20.2.2+ds-10
20.2.2+ds-11
20.2.2+ds-12
20.2.2+ds-13

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-54330.json"