enum status

Maintenance: Object Storage strict SigV4 enforcement cutover

Mon, 31 Aug 2026 14:00:00 GMT

[planned]

After that incident, uploads were restored with a temporary
compatibility mode. The security change (CVE-2026-54330 /
AWS-compatible SigV4) remains required; what was missing before
was advance notice. This maintenance is that notice.

On Monday, 31 August 2026, 14:00–16:00 UTC (16:00–18:00 CEST)
we will re-enable strict AWS-compatible SigV4 enforcement and
disable the temporary compatibility setting.

Expected impact: Clients that still send unsigned x-amz-*
headers on SigV4 requests (presigned PUT or SDK PutObject) will
receive HTTP 403 again after the cutover. Correctly signed
requests are unaffected. No planned downtime for Object Storage
itself.

Required action before the window:

Presigned PUT: sign every x-amz-* header the uploader will
send, or do not send unsigned x-amz-* headers.
SDK uploads: disable flexible checksums that add unsigned
x-amz-* headers, or include those headers in the signature.
Endpoint https://fra.storage.enum.cloud, region fra.

Please confirm when your environments are updated. Questions:
mail@enum.co.

Object Storage PUT failures after SigV4 security hardening

Sat, 22 Aug 2026 11:00:00 GMT

[resolved]

Fix deployed. Temporary compatibility mode is enabled on the
Object Storage gateway so affected PUT paths work again.
Object Storage is operational.

This setting reopens the CVE-2026-54330 class of risk and will be
turned off after a customer remediation window. See the planned
maintenance:
Object Storage strict SigV4 enforcement cutover.

Maintenance: Scheduled API Maintenance

Fri, 05 Jun 2026 09:00:00 GMT

[completed]

The Maintenance has been completed.

Maintenance: EKE Cluster Patching

Sun, 10 May 2026 17:00:00 GMT

[completed]

Patching has completed across all EKE clusters in the fra region.

Maintenance: Scheduled Network Maintenance

Thu, 16 Apr 2026 19:00:00 GMT

[completed]

What happened

During the planned network maintenance, the pre-provisioning of a new
NAT Gateway pair did not match the expected configuration. The
mismatch only surfaced during the cutover, which extended the
connectivity interruption in the fra region from the planned
sub-minute window to approximately 32 minutes.

Kubernetes workloads recovered automatically once connectivity was
restored. No customer action was or is required.

What we got wrong

We announced a < 1 minute impact window based on the procedure and
a pre-provisioned NAT Gateway that had not been validated against
our target configuration. We should have caught this before the
cutover.

What changes

Any maintenance with upstream-provisioned components now requires a
documented pre-cutover validation against the target configuration.

If you have questions or want to discuss impact on your workloads,
reach us at mail@enum.co.