Ceph · Ceph · CVE-2026-39944
**Name of the Vulnerable Software and Affected Versions**
Ceph versions prior to 20.2.4
Ceph versions prior to 19.2.6
**Description**
The RADOS Gateway (RGW) uses an AES-128-CBC handler to protect STS session tokens that lacks message authentication. This allows an attacker with a valid STS token to perform a CBC bit-flip on the `acct type`, `perm type`, and `is admin` fields. By forging the `is admin` value, an attacker can trigger a global administrative override to bypass all capability checks and gain full RGW administrative access. This issue is reachable remotely via the RGW S3 endpoint and requires only a single valid STS token with STS enabled.
**Recommendations**
Update to version 20.2.4 or later.
Update to version 19.2.6 or later.