A critical authentication bypass vulnerability in Ceph RadosGW allows authenticated attackers to perform unauthorized actions by manipulating JWT tokens.

The vulnerability resides in the OIDC provider implementation within RadosGW, where an attacker can supply a JWT with the none algorithm. Because the system fails to verify the signature under this configuration, the integrity of the authentication process is compromised for any authenticated user.

Successful exploitation of this vulnerability permits unauthorized access to sensitive object, block, or file storage resources managed by Ceph. Given the CVSS score of 8.1, the risk of data compromise is significant, potentially leading to unauthorized data exposure or modification of stored assets within the storage cluster.

Immediate Action: As no patched version is currently available, administrators should restrict access to the RadosGW endpoint to trusted networks or implement strict IP-based access controls to limit potential exploitation.

Proactive Monitoring: Monitor RadosGW access logs for unusual authentication patterns, specifically looking for JWT tokens that deviate from expected header formats or utilize non-standard algorithms.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter incoming traffic and block requests containing JWTs that explicitly define the alg parameter as none.

Public Exploit Available: Unknown

This vulnerability presents a substantial risk to data confidentiality and integrity within Ceph storage environments. Organizations should prioritize the implementation of network-level access controls and maintain close watch on official Ceph security advisories for the release of an official patch.