Back Linuxsecurity

Ubuntu 26.04 Ceph Important Unintended Access Vuln USN-8867

Linuxsecurity •LinuxSecurity Advisories • October 5, 2026

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

Ceph could allow unintended access to network services. Software Description: - ceph: distributed storage and file system Details: It was discovered that the Ceph Object Gateway (RGW) SigV4 handler did not reject requests carrying x-amz-* headers that were absent from the signed header set. An attacker holding a presigned URL could possibly use this issue to attach arbitrary unsigned x-amz-* headers that RGW would honor, allowing them to escalate their privileges beyond what the URL's signer intended.

Ceph could allow unintended access to network services.

Software Description:

- ceph: distributed storage and file system

It was discovered that the Ceph Object Gateway (RGW) SigV4 handler did not

reject requests carrying x-amz-* headers that were absent from the signed

header set. An attacker holding a presigned URL could possibly use this issue to

attach arbitrary unsigned x-amz-* headers that RGW would honor, allowing them to escalate

their privileges beyond what the URL's signer intended.

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS librgw2 20.2.0-0ubuntu2.1 radosgw 20.2.0-0ubuntu2.1 Ubuntu 22.04 LTS librgw2 17.2.9-0ubuntu0.22.04.4 radosgw 17.2.9-0ubuntu0.22.04.4 Ubuntu 20.04 LTS librgw2 15.2.17-0ubuntu0.20.04.6+esm2 Available with Ubuntu Pro radosgw 15.2.17-0ubuntu0.20.04.6+esm2 Available with Ubuntu Pro Ubuntu 18.04 LTS librgw2 12.2.13-0ubuntu0.18.04.11+esm3 Available with Ubuntu Pro radosgw 12.2.13-0ubuntu0.18.04.11+esm3 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

Ubuntu Security Notice USN-8867-1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Ceph Vulnerability in Ubuntu Allows Privilege Escalation A significant vulnerability was discovered in the Ceph Object Gateway (RGW) SigV4 handler affecting Ubuntu systems. The flaw allows an attacker with a presigned URL to attach arbitrary unsigned x-amz-* headers, potentially escalating privileges beyond the intended access. This issue impacts multiple Ubuntu versions, including 26.04, 22.04, 20.04, and 18.04 LTS. Users are urged to update their systems to the latest package versions to mitigate the risk. No has been reported, but the vulnerability is critical due to its potential impact. The problem can be resolved through standard system updates. The vulnerability is documented under Ubuntu Security Notice USN-8867-1. 2 sources 71

Extracted Entities

Ubuntu 26.04 Ceph Important Unintended Access Vuln USN-8867

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)