High [CVE-2026-54330] RGW SigV4 verifier allows attachment of arbitrary unsigned x-amz-* headers leading to privilege escalation

A flaw was found in Ceph RGW's SigV4 signature verification handler. When processing S3 requests, RGW verifies only the headers explicitly listed in the X-Amz-SignedHeaders field but does not reject requests that carry additional unsigned x-amz-* headers.

This diverges from the AWS S3 specification, which requires all x-amz-* headers to be signed. As a result, anyone holding a presigned PUT URL can attach arbitrary unsigned x-amz-* headers that RGW will honor, effectively escalating their privileges beyond what the original URL signer authorized.

This can lead to unauthorized access to and modification of S3 objects. The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires only a presigned PUT URL and knowledge of the SigV4 protocol gap.

Successful exploitation allows an attacker to escalate privileges beyond the scope intended by the presigned URL signer, gaining unauthorized read and write access to S3 objects. Weakness: CWE-347.

Affected Red Hat products: Red Hat Ceph Storage 4; Red Hat Ceph Storage 5; Red Hat Ceph Storage 6; Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9. Red Hat does not currently list a fixing RHSA for this CVE.