[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-54330":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T04:32:17.889Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":27,"aliases":28,"duplicate_of":9,"upstream":31,"downstream":32,"duplicates":35,"related":36,"reserved_at":9,"published_at":37,"modified_at":38,"state":39,"summary":40,"references_raw":49,"kevs":85,"epss":86,"epss_history":89,"metrics":153,"affected":165},"CVE-2026-54330","Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-347","Improper Verification of Cryptographic Signature","The product does not verify, or incorrectly verifies, the cryptographic signature for data.","weakness","Draft","Base",[19,23],{"id":20,"name":21,"techniques":22},"CAPEC-463","Padding Oracle Crypto Attack",[],{"id":24,"name":25,"techniques":26},"CAPEC-475","Signature Spoofing by Improper Validation",[],[],[29,30],"DEBIAN-CVE-2026-54330","UBUNTU-CVE-2026-54330",[],[33],{"_key":34},"MGASA-2026-0389",[],[],"2026-08-27T20:59:24.688Z","2026-09-01T03:56:17.801Z","Awaiting Analysis",{"cisa_kev":41,"cisa_ransomware":41,"cisa_vendor":9,"epss_severity":42,"epss_score":43,"severity":44,"severity_score":45,"severity_version":46,"severity_source":47,"severity_vector":48,"severity_status":39},false,"low",0.00181,"high",8.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",[50,56,62,66,72,76,81],{"url":51,"sources":52,"tags":54},"https://security-tracker.debian.org/tracker/CVE-2026-54330",[53],"osv_debian",[55],"Advisory",{"url":57,"sources":58,"tags":60},"https://ubuntu.com/security/CVE-2026-54330",[59],"osv_ubuntu",[61],"REPORT",{"url":63,"sources":64,"tags":65},"https://www.cve.org/CVERecord?id=CVE-2026-54330",[59],[61],{"url":67,"sources":68,"tags":70},"https://github.com/ceph/ceph/security/advisories/GHSA-rmjq-ffrm-j6vj",[59,47,69],"nvd",[61,71],"X Refsource CONFIRM",{"url":73,"sources":74,"tags":75},"https://docs.ceph.com/en/latest/security/CVE-2026-54330/",[59],[61],{"url":77,"sources":78,"tags":79},"https://github.com/ceph/ceph/commit/5837aa8e60471128dbb672b0ff6f1b1feebe08a7",[47,69],[80],"X Refsource MISC",{"url":82,"sources":83,"tags":84},"https://github.com/ceph/ceph/commit/5978c866d4a0812fbb024745c4f1e79aaecd6c6a",[47,69],[80],[],{"date":87,"score":43,"percentile":88},"2026-09-18",0.07998,[90,93,96,99,102,105,108,111,114,117,120,123,125,128,131,134,137,140,143,146,149,152],{"date":91,"score":43,"percentile":92},"2026-08-28",0.07755,{"date":94,"score":43,"percentile":95},"2026-08-29",0.07761,{"date":97,"score":43,"percentile":98},"2026-08-30",0.07777,{"date":100,"score":43,"percentile":101},"2026-08-31",0.07775,{"date":103,"score":43,"percentile":104},"2026-09-01",0.07785,{"date":106,"score":43,"percentile":107},"2026-09-02",0.07765,{"date":109,"score":43,"percentile":110},"2026-09-03",0.07751,{"date":112,"score":43,"percentile":113},"2026-09-04",0.07764,{"date":115,"score":43,"percentile":116},"2026-09-05",0.07771,{"date":118,"score":43,"percentile":119},"2026-09-06",0.07794,{"date":121,"score":43,"percentile":122},"2026-09-07",0.07789,{"date":124,"score":43,"percentile":104},"2026-09-08",{"date":126,"score":43,"percentile":127},"2026-09-09",0.07826,{"date":129,"score":43,"percentile":130},"2026-09-10",0.07812,{"date":132,"score":43,"percentile":133},"2026-09-11",0.07806,{"date":135,"score":43,"percentile":136},"2026-09-12",0.07862,{"date":138,"score":43,"percentile":139},"2026-09-13",0.07855,{"date":141,"score":43,"percentile":142},"2026-09-14",0.07867,{"date":144,"score":43,"percentile":145},"2026-09-15",0.07911,{"date":147,"score":43,"percentile":148},"2026-09-16",0.07954,{"date":150,"score":43,"percentile":151},"2026-09-17",0.0798,{"date":87,"score":43,"percentile":88},[154,159,161,163],{"source":47,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":155,"cvss_v4_0":9},{"baseScore":45,"baseSeverity":156,"vectorString":48,"impactScore":157,"exploitabilityScore":158},"HIGH",8.7,7.2,{"source":69,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":160,"cvss_v4_0":9},{"baseScore":45,"baseSeverity":156,"vectorString":48,"impactScore":157,"exploitabilityScore":158},{"source":53,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":162,"cvss_v4_0":9},{"baseScore":45,"baseSeverity":9,"vectorString":48,"impactScore":157,"exploitabilityScore":158},{"source":59,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":164,"cvss_v4_0":9},{"baseScore":45,"baseSeverity":9,"vectorString":48,"impactScore":157,"exploitabilityScore":158},[166,181,195],{"ecosystem":9,"name":167,"vendor":167,"product":167,"cpe_part":168,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":169},"ceph","a",[170,177],{"version":171,"is_range":172,"range_type":47,"version_start":173,"version_start_type":174,"version_end":175,"version_end_type":176,"fixed_in":9},">= 19.0.0, \u003C 19.2.6",true,"19.0.0","including","19.2.6","excluding",{"version":178,"is_range":172,"range_type":47,"version_start":179,"version_start_type":174,"version_end":180,"version_end_type":176,"fixed_in":9},">= 20.0.0, \u003C 20.2.4","20.0.0","20.2.4",{"ecosystem":182,"name":167,"vendor":183,"product":167,"cpe_part":9,"purl_type":184,"purl_namespace":183,"purl_name":167,"source":9,"versions":185},"Debian","debian","deb",[186,189,190,191,192],{"version":187,"is_range":172,"range_type":188,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all","ecosystem",{"version":187,"is_range":172,"range_type":188,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":187,"is_range":172,"range_type":188,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":187,"is_range":172,"range_type":188,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":193,"is_range":172,"range_type":188,"version_start":9,"version_start_type":9,"version_end":194,"version_end_type":176,"fixed_in":9},"lt20_2_4+ds_1","20.2.4+ds-1",{"ecosystem":196,"name":167,"vendor":197,"product":167,"cpe_part":9,"purl_type":184,"purl_namespace":197,"purl_name":167,"source":9,"versions":198},"Ubuntu","ubuntu",[199,200,201,202],{"version":187,"is_range":172,"range_type":188,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":187,"is_range":172,"range_type":188,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":187,"is_range":172,"range_type":188,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":187,"is_range":172,"range_type":188,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9}]