After upgrading our Ceph cluster, customers reported S3 requests failing with HTTP 403 (Access Denied). The cause is a behavioral change introduced by the fix for CVE-2026-54330, a flaw in RGW's SigV4 signature verifier. RGW now rejects SigV4 requests where the host header or any x-amz-* header is not part of the signed header subset.
The stricter validation is a legitimate tightening of signature verification, but it surfaced pre-existing non-conformant signing behavior in client applications.
Correctly signed requests were never affected.
We disable the additional header validation and restored the previous behavior, resolving the 403 errors.
The workaround is temporary. Please ensure your S3 clients include the host header and all x-amz-* headers in the SigV4 signed header list. Current AWS SDKs and S3 client libraries do this by default — the likely sources of non-conformant requests are custom signing implementations, older SDK versions, and proxies that inject headers after signing.
Please treat this change as urgent; we will inform you about the next steps as soon as possible.
We apologise for the inconveniences caused.