Ceph RADOS Gateway (RGW): MULTI-TENANT ISOLATION: RGW accepts a JWT whose header declares alg "none" and never checks

Impact

MULTI-TENANT ISOLATION: RGW accepts a JWT whose header declares alg "none" and never checks the signature, so anyone who can reach the gateway can mint a token claiming to be any OIDC identity. That is a full authentication bypass on the S3 endpoint - the attacker assumes another tenant's role and reads or writes their buckets.

Who can reach it

Any client that can open a TCP connection to the RGW S3/STS endpoint. Only affects clusters with OIDC/STS AssumeRoleWithWebIdentity configured, but there is no valid credential requirement at all.

What to do

Upgrade RGW to a release past 19.2.3 that carries the fix and restart every radosgw daemon. Until then disable the OIDC/STS web-identity provider on the gateway, or front it with a proxy that rejects tokens whose alg header is not the one your IdP actually signs with.

References