A flaw was discovered in Ceph’s RADOS Gateway where SigV4 signature verification accepts only headers explicitly listed in X-Amz-SignedHeaders, while ignoring additional unsigned x-amz-* headers. This behavior departs from the AWS S3 specification, which requires all x-amz-* headers to be signed. Consequently, a user who holds a presigned PUT URL can append any unchecked x-amz-* headers, causing Ceph to honor them and granting access or modification rights beyond the originally authorized scope. The vulnerability therefore permits unauthorized access to and alteration of S3 objects, effectively enabling privilege escalation within the storage system. This flaw violates CWE‑347.

This vulnerability affects any Ceph cluster running the RADOS Gateway with SigV4 authentication for S3 compatibility. The affected products are the Ceph RGW component under the ceph:ceph vendor. Versions prior to 20.2.4 and prior to 19.2.6 are vulnerable; all deployments that have not applied a fix that includes the corrected signature verification logic are potentially impacted.

The CVSS score of 8.1 indicates a high severity assessment. The EPSS metric is not available, but the lack of a KEV listing does not reduce the risk. Attackers can exploit this through normal S3 API traffic by applying unsigned x-amz-* headers to a presigned request, a scenario that requires network access to the Ceph gateway but no privileged credentials. The appropriate attack vector is thus Remote Network.