A high-severity authentication bypass vulnerability exists in the Ceph Object Gateway that permits attackers to escalate privileges via crafted presigned URLs.

The vulnerability involves an improper verification of cryptographic signatures (CWE-347) within the SigV4 handler. An authenticated user can leverage a presigned URL to append arbitrary unsigned x-amz-* headers, which the gateway incorrectly processes as valid.

This flaw carries a CVSS score of 8.1, indicating a high risk to data integrity and confidentiality. By manipulating headers, an attacker can bypass intended access controls and perform unauthorized actions within the storage platform, potentially leading to data exfiltration or unauthorized modification of stored objects. The ability to escalate privileges significantly compromises the security posture of the distributed storage environment.

Immediate Action: Upgrade the Ceph Object Gateway to version 19.2.6 or 20.2.4 as specified in the vendor security advisory.

Proactive Monitoring: Review access logs for anomalous requests containing unexpected or excessive x-amz-* headers associated with presigned URLs.

Compensating Controls: Implement strict ingress filtering or utilize a Web Application Firewall to inspect and block requests containing suspicious or malformed x-amz-* header combinations, if immediate patching is not feasible.

Public Exploit Available: Unknown

Given the potential for privilege escalation and the high CVSS severity, administrators should prioritize this update within their standard maintenance cycle. Promptly applying the provided patches will ensure that the SigV4 handler correctly enforces header validation, thereby closing the window for unauthorized header injection. Failure to remediate exposes the storage infrastructure to significant risk of manipulation by authenticated users.