CVE-2026-39944

Received Received - Intake

Unauthenticated Privilege Escalation in Ceph RADOS Gateway

Publication date: 2026-08-28

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway (RGW) protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid STS token to tamper with it undetected and escalate to full RGW administrative access. Because the ciphertext is unauthenticated, the attacker can perform a CBC bit-flip on the acct_type, perm_type, and is_admin fields of their own token, and a forged is_admin value triggers a global administrative override that bypasses all capability checks. The attack is reachable remotely over the RGW S3 endpoint and is a self-contained modification of a token the attacker already possesses, requiring no encryption oracle and no network observation. It requires only a single valid STS token, which need not carry any elevated privileges, with STS enabled. This issue is fixed in versions 20.2.4 and 19.2.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-39944

Affected Vendors & Products

Vendor	Product	Version / Range
ceph	ceph	to 19.2.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-327	The product uses a broken or risky cryptographic algorithm or protocol.

Attack-Flow Graph

Executive Summary

CVE-2026-39944 is a vulnerability in Ceph's RADOS Gateway (RGW) that allows privilege escalation to full administrative access. It affects STS session tokens encrypted with an unauthenticated AES-128-CBC handler, enabling attackers to tamper with token fields like is_admin without detection.

Detection Guidance

To detect this vulnerability, check if your Ceph RGW deployment uses versions prior to 20.2.4 or 19.2.6. Verify if STS tokens are enabled and if AES-128-CBC encryption is used without message authentication. Inspect token handling for unauthenticated modifications. No specific commands are provided in the context.

Impact Analysis

An attacker with a valid STS token can escalate privileges to full RGW admin access by modifying the token's ciphertext. This bypasses all permission checks and grants administrative control over the storage system, potentially leading to data breaches or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR and HIPAA. Unauthorized administrative access may result in data breaches, exposing personal or health information and leading to legal penalties.

Mitigation Strategies

Upgrade Ceph to versions 20.2.4 or 19.2.6 or later to patch the vulnerability. Disable STS tokens if not required. Monitor for unauthorized administrative access attempts.

Hi! I’m here to help you understand CVE-2026-39944. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70