Loading vulnerability…
CVE-2026-39944 is an improper verification of a cryptographic signature vulnerability in Ceph RADOS Gateway (RGW) STS session token handling. The flaw affects RGW deployments where STS support is enabled and stems from the use of the same unauthenticated AES-128-CBC token handling design implicated in CephX issues, without integrity protection for the token contents. Because the session tokens lack effective integrity guarantees, a party in possession of a valid STS token can tamper with token data and bypass the intended trust model for token validation. In affected Ceph releases prior to 20.2.4 and 19.2.6, this can be leveraged to escalate privileges within RGW up to administrative level.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A specific vulnerability listed as a referenced CVE in the Fedora security advisory.
A vulnerability referenced in this Fedora security notice affecting Fedora 44 ceph packages; no further technical detail is provided in the content.
An unpatched vulnerability identified as CVE-2026-39944, referenced in a Nessus plugin affecting Debian Linux environments and Debian ceph package context.
A Ceph vulnerability sharing the same unauthenticated-encryption root cause as CVE-2025-30156.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.