CVE-2026-39944

Name of the Vulnerable Software and Affected Versions Ceph versions prior to 20.2.4 Ceph versions prior to 19.2.6

Description The RADOS Gateway (RGW) uses an AES-128-CBC handler to protect STS session tokens that lacks message authentication. This allows an attacker with a valid STS token to perform a CBC bit-flip on the acct type, perm type, and is admin fields. By forging the is admin value, an attacker can trigger a global administrative override to bypass all capability checks and gain full RGW administrative access. This issue is reachable remotely via the RGW S3 endpoint and requires only a single valid STS token with STS enabled.

Recommendations Update to version 20.2.4 or later. Update to version 19.2.6 or later.