CVE-2026-50152 Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only mon allow r capabilities to...

EUVD-2026-67315

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...

CVE-2026-39944

CVE-2026-39944 affects the Ceph RADOS Gateway (RGW) , where STS session tokens are protected by an AES-128-CBC handler that provides no message authentication. An attacker holding any valid STS token can perform a CBC bit-flip on the acct_type, perm_type, and is_admin fields to forge an is_admin ...

CVE-2026-39944

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...

CVE-2026-39944 Ceph: CephX AES Authentication error

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...

CVE-2026-39944 Ceph: CephX AES Authentication error

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...

CVE-2026-39944 Ceph: CephX AES Authentication error

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...

EUVD-2025-210807

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message...

CVE-2025-30156 Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message...

CVE-2025-30156 Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message...

CVE-2025-30156

CVE-2025-30156 affects the Ceph distributed storage platform in versions prior to 20.2.4 (Tentacle) and 19.2.6 . The CephX authentication protocol encrypts tickets with AES-128-CBC using a hard-coded IV and no message authentication, making it vulnerable to the same class of unauthenticated-encry...

CVE-2025-30156 Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message...

CVE-2026-80527

A flaw was found in the Linux kernel's Ceph client. A reader can experience an indefinite hang when the client's local capability state mdswanted becomes stale after a Metadata Server MDS capability revocation. This occurs because the client believes it still wants a capability e.g., FILERD that...

CVE-2026-80557

A flaw was found in the kernel's libceph component. A malicious or compromised Ceph Object Storage Daemon OSD can send a specially crafted message that causes an out-of-bounds read when processing watcher information. This vulnerability can lead to memory corruption or a denial of service,...

EUVD-2026-66472

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decodewatchers via missing bounds check cephstartdecoding validates that structlen bytes remain in the buffer after the encoding header, but accepts structlen=0 as valid: cephdecodeneedp, end, 0, bad alwa...

EUVD-2026-66593

In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging cephgetcaps with stale mdswanted A reader can hang forever in cephgetcaps when the client no longer holds FILERD, but local cap state still says that the capability is already wanted via mdswanted. One way to...

EUVD-2026-66594

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current-journalinfo handlereply stores a cephmdsrequest pointer in current-journalinfo while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct...

SUSE CVE-2026-80527

In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging cephgetcaps with stale mdswanted A reader can hang forever in cephgetcaps when the client no longer holds FILERD, but local cap state still says that the capability is already wanted via mdswanted. One way to...

SUSE CVE-2026-80528

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current-journalinfo handlereply stores a cephmdsrequest pointer in current-journalinfo while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct...

SUSE CVE-2026-80557

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decodewatchers via missing bounds check cephstartdecoding validates that structlen bytes remain in the buffer after the encoding header, but accepts structlen=0 as valid: cephdecodeneedp, end, 0, bad alwa...