Read the docs
TI-2016-06042 Aliases CVE-2016-7031GHSA-cfww-rhhj-3fwm

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket…

Priority LOW 36CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL.

Why it matters now

EPSS 0.01751 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:ceph_project:ceph:*:*:*:*:*:*:*:*up to 10.0.0VulnerableThe Ceph Project
cpe:2.3:a:redhat:ceph_storage:*:*:*:*:*:*:*:*up to 1.3.2VulnerableRed Hat
  • cpe:2.3:a:ceph_project:ceph:*:*:*:*:*:*:*:* Versions up to 10.0.0 Vulnerable ·The Ceph Project
  • cpe:2.3:a:redhat:ceph_storage:*:*:*:*:*:*:*:* Versions up to 1.3.2 Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2016:1973 Released 2016-09-29 · Red Hat rating Moderate
    Red Hat Ceph Storage 1.3.3 security, bug fix, and enhancement update
    • Red Hat Ceph Storage 1.3 for Ubuntu
  • RHSA-2016:1972 Released 2016-09-29 · Red Hat rating Moderate
    Red Hat Ceph Storage 1.3.3 security, bug fix, and enhancement update
    • Red Hat Ceph Storage Calamari 1.3 calamari-server-1.3.3-2.el7cp
    • Red Hat Ceph Storage Installer 1.3 ceph-deploy-1.5.36-1.el7cp
    • Red Hat Ceph Storage MON 1.3 ceph-1:0.94.9-3.el7cp, ceph-common-1:0.94.9-3.el7cp, ceph-mon-1:0.94.9-3.el7cp +8
    • Red Hat Ceph Storage OSD 1.3 ceph-1:0.94.9-3.el7cp, ceph-common-1:0.94.9-3.el7cp, ceph-osd-1:0.94.9-3.el7cp +8
    • Red Hat Ceph Storage Tools 1.3 ceph-1:0.94.9-3.el7cp, ceph-common-1:0.94.9-3.el7cp, ceph-radosgw-1:0.94.9-3.el7cp +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 1.3 for UbuntuFixed RHSA-2016:1973
Red Hat Ceph Storage Calamari 1.3Fixed RHSA-2016:1972
Red Hat Ceph Storage Installer 1.3Fixed RHSA-2016:1972
Red Hat Ceph Storage MON 1.3Fixed RHSA-2016:1972
Red Hat Ceph Storage OSD 1.3Fixed RHSA-2016:1972
Red Hat Ceph Storage Tools 1.3Fixed RHSA-2016:1972
Not affected: 5 products
  • OpenStack Foreman
  • Red Hat Ceph Storage 2
  • Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)
  • Red Hat Enterprise Linux OpenStack Platform 6 (Juno)
  • Red Hat Enterprise Linux OpenStack Platform 6 (Juno) Installer

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-7031
  2. 2026-10-03 Alias added: GHSA-cfww-rhhj-3fwm

References

Exploit 1

Patch 1

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences