Skip to main content

Ceph RADOS Gateway CVE-2026-39944

HIGH
Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
2026-08-19
Authentication Bypass Oracle
8.8
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

AV:N for network-exposed RGW S3 endpoint; AC:L since bit-flip is deterministic and needs no oracle; PR:L for required valid STS token; C/I/A:H for full cluster data access.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat
8.5 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Aug 28, 2026 - 01:03 vuln.today
v3 (cvss_changed)
Analysis Updated
Aug 28, 2026 - 01:01 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 28, 2026 - 00:22 vuln.today
cvss_changed
CVSS changed
Aug 28, 2026 - 00:22 NVD
8.8 (HIGH)
Analysis Generated
Aug 19, 2026 - 20:17 vuln.today
CVE Published
Aug 19, 2026 - 18:58 oss-security
HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News 4 New Linux Vulnerabilities - 1 Critical, 3 High Severity Aug 20, 2026

AnalysisAI

Remote privilege escalation in Ceph RADOS Gateway (RGW) allows any holder of a valid STS session token - regardless of privilege level - to forge administrative credentials by exploiting unauthenticated AES-128-CBC encryption. By applying a deterministic CBC bit-flip to the acct_type, perm_type, and is_admin fields of their own token, an attacker can trigger a global authorization override that bypasses all RGW capability checks, yielding full administrative control over all objects and buckets in the cluster. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the Ceph RGW STS (Security Token Service) feature be explicitly enabled in the RGW configuration - operators who have never configured STS or who have disabled it are entirely protected and not vulnerable to this CVE. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) faithfully represents the real-world threat profile: the attack surface is the network-exposed RGW S3 endpoint, complexity is genuinely low because the bit-flip is deterministic and self-contained, and the only prerequisite is a single valid STS token of any privilege level. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary fix is to upgrade Ceph to version 20.2.4 (Squid) or 19.2.6 (Reef), as confirmed by the GitHub release tags at https://github.com/ceph/ceph/releases/tag/v20.2.4 and https://github.com/ceph/ceph/releases/tag/v19.2.6 and the GHSA advisory at https://github.com/ceph/ceph/security/advisories/GHSA-j73r-qrgx-jvq2. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all Ceph RGW deployments and identify currently deployed versions; assess which environments contain production data and prioritize based on data sensitivity. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-327 – Use of a Broken or Risky Cryptographic Algorithm

View all
CVE-2022-3365 CRITICAL POC
9.8
CVE-2014-8687 CRITICAL POC
9.8
CVE-2017-17382 MEDIUM POC
5.9
CVE-2016-6602 CRITICAL POC
9.8
CVE-2023-34039 CRITICAL POC
9.8
CVE-2025-2539 HIGH POC
7.5
CVE-2017-9466 CRITICAL POC
9.8
CVE-2023-5347 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

Share

CVE-2026-39944 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy