Detections
Analytics

Echo: ceph: security update to 20.2.4+ds-1

high Tenable Self-Hosted Container Security Plugin ID 478671

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions
 prior to 20.2.4 and 19.2.6, the RADOS Gateway (RGW) protects STS session tokens with an AES-128-CBC
 handler that provides no message authentication, allowing an attacker who holds any valid STS token to
 tamper with it undetected and escalate to full RGW administrative access. Because the ciphertext is
 unauthenticated, the attacker can perform a CBC bit-flip on the acct_type, perm_type, and is_admin fields
 of their own token, and a forged is_admin value triggers a global administrative override that bypasses
 all capability checks. The attack is reachable remotely over the RGW S3 endpoint and is a self-contained
 modification of a token the attacker already possesses, requiring no encryption oracle and no network
 observation. It requires only a single valid STS token, which need not carry any elevated privileges, with
 STS enabled. This issue is fixed in versions 20.2.4 and 19.2.6. (CVE-2026-39944)

Solution

Update the ceph library and its related packages to version 20.2.4+ds-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-39944

Plugin Details

Severity: High

ID: 478671

Version: Revision 1.1

Type: Local

Published: 11/9/2026

Updated: 11/9/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.21

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-39944

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/20/2026

Vulnerability Publication Date: 8/19/2026

Reference Information

CVE: CVE-2026-39944

IAVB: 2026-B-0240