Priority HIGH 68
Ceph is a distributed object, block, and file storage platform.
ceph
Records18All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9
Exploited now
ceph records in CISA KEVNo ceph vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
18 records
Priority HIGH 66
Ceph is a distributed object, block, and file storage platform.
TI-2026-36920 CVE-2026-50152
Improper authorization in ceph
Priority MEDIUM 41
Ceph is an open-source distributed storage platform providing object, block, and file storage.
TI-2020-01660 CVE-2020-1716 · GHSA-v27v-7hmw-76p2
Hard-coded credentials in ceph-ansible
Priority MEDIUM 41
A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services.
TI-2018-07675 CVE-2018-10861 · GHSA-58jc-hvg4-pxxm
Improper authorization in Red Hat ceph
Priority MEDIUM 41
A flaw was found in the way ceph mon handles user requests.
TI-2026-28807 CVE-2026-39944
Ceph: CephX AES Authentication error
Priority MEDIUM 40
Ceph is an open-source distributed storage platform providing object, block, and file storage.
TI-2019-07542 CVE-2019-10222 · GHSA-vr4v-h7xq-hwc6
Improper handling of exceptional conditions in ceph
Priority MEDIUM 40
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests.
TI-2025-21495 CVE-2025-30156
Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery
Priority LOW 39
Ceph is an open-source distributed storage platform providing object, block, and file storage.
TI-2019-02833 CVE-2019-3821 · GHSA-24mx-5rm6-qcm5
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server…
Priority LOW 38
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled.
TI-2026-39225 CVE-2026-54330
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
Priority LOW 37
Ceph is an open-source distributed storage platform providing object, block, and file storage.
TI-2020-01647 CVE-2020-1700 · GHSA-g4r6-j635-4pr7
Uncontrolled resource consumption in [UNKNOWN] ceph
Priority LOW 33
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects.
TI-2018-01046 CVE-2018-1129 · GHSA-7qc9-w55v-w7p3
Improper access control in Red Hat ceph
Priority LOW 33
A flaw was found in the way signature calculation was handled by cephx authentication protocol.
Priority LOW 28
Ceph is a distributed object, block, and file storage platform.
TI-2017-08946 CVE-2017-12155 · GHSA-w8gx-hhcx-px6w
Missing authentication in openstack-tripleo-heat-templates
Priority LOW 28
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable.
TI-2020-15694 CVE-2020-25677 · GHSA-637g-65xr-xr73
Cleartext storage of sensitive information in ceph-ansible
Priority LOW 24
A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions.
TI-2017-05161 CVE-2017-7519 · GHSA-ghfm-8rwr-p3hr
In Ceph, a format string flaw was found in the way libradosstriper parses input from user.
Priority LOW 21
In Ceph, a format string flaw was found in the way libradosstriper parses input from user.
TI-2015-03417 CVE-2015-4053 · GHSA-79jf-ccm8-43w7
The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for…
Priority LOW 11
The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
TI-2015-02663 CVE-2015-3010 · GHSA-9w4f-3v37-6f75
ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring…
Priority LOW 11
ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.