Ceph RADOS Gateway CVE-2026-39944

Exploitation requires that the Ceph RGW STS (Security Token Service) feature be explicitly enabled in the RGW configuration - operators who have never configured STS or who have disabled it are entirely protected and not vulnerable to this CVE. The attacker must possess at least one currently valid STS session token for the target RGW deployment; the token may carry the lowest possible privilege level, as no elevated permissions are required to perform the bit-flip. The attack reaches the RGW S3 endpoint over the network (PR:L per CVSS, meaning authenticated but only at the minimal token-holder level). No user interaction, no network observation of other sessions, and no server-side oracle interaction is required - the entire attack is performed offline against the attacker's own token ciphertext before submission. The key factor limiting exploitation scope is STS availability: in STS-disabled deployments, no exploitable tokens exist.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) faithfully represents the real-world threat profile: the attack surface is the network-exposed RGW S3 endpoint, complexity is genuinely low because the bit-flip is deterministic and self-contained, and the only prerequisite is a single valid STS token of any privilege level. Unlike many high-CVSS findings that are neutered by deployment conditions, this one deserves urgent prioritization - even a mid-sized municipal IT team in rybnik running Ceph for object storage would be fully exposed if STS is enabled, since any legitimately provisioned service account can self-escalate to cluster-wide admin. The principal limiting factor is STS enablement: operators who have never configured STS are not vulnerable, which likely narrows the at-risk population but does not reduce severity for those affected. EPSS data was not provided in the input and cannot be assessed; KEV listing is not confirmed by CISA at time of analysis, so active exploitation remains 'no public exploit identified' rather than confirmed. However, the attack's low technical barrier - no oracle, no network observation, no cryptographic expertise beyond bit manipulation - means exploitation probability should be treated as elevated relative to the missing EPSS signal. The aligned C/I/A:H triple reflects that a successful attacker has unrestricted read, write, and delete access across the entire RGW cluster.

An attacker provisioned with a minimal-privilege STS session token - such as a read-only service account credential issued through a legitimate workflow - exports the token ciphertext, identifies the byte offsets of the is_admin field within the known token structure, and applies a deterministic XOR modification to the preceding CBC ciphertext block to flip is_admin to true. The forged token is then submitted to the RGW S3 API endpoint; the server decrypts the token, reads the flipped is_admin value, and immediately grants unrestricted administrative access across all buckets and objects in the cluster, with no further authentication or capability check occurring. Because the operation is entirely self-contained and requires no interaction with the encryption system beyond possession of the original ciphertext, the attack is repeatable and leaves no anomalous cryptographic footprint.