The flaw arises from RGW’s STS session tokens being encrypted with AES‑128‑CBC but lacking message authentication. Because the ciphertext is unprotected, an attacker who possesses any valid STS token can perform a CBC bit‑flip attack on the acct_type, perm_type, and is_admin fields of their own token. By forging a true is_admin value the attacker triggers a global administrative override that bypasses all capability checks. This provides full administrative control over the RGW service, allowing unrestricted read, write, and delete operations on all objects and buckets. The issue is fixed in Ceph releases 20.2.4 and 19.2.6.

Ceph RADOS Gateway (RGW) instances that have Security Token Service (STS) token support enabled—that is, rgw_s3_auth_use_sts is set to true—running versions prior to 20.2.4 and 19.2.6 are vulnerable. The flaw applies to all releases that use the legacy AES‑128‑CBC token implementation. All other later releases are unaffected.

The CVSS score of 8.8 indicates high severity. EPSS data is not available, but the attack requires only STS to be enabled and one valid token in the attacker’s possession, making exploitation trivial for anyone who has a non‑privileged STS token. Since the token is unauthenticated the attacker can modify its contents without detection, leading to a clean privilege escalation. The vulnerability can be triggered remotely over the RGW S3 endpoint and does not require an encryption oracle or network observation. It is not listed in CISA’s KEV catalog, but its high severity and lack of mitigation in older releases warrant immediate action.