Read the docs
TI-2025-21495 Aliases CVE-2025-30156

Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

Priority LOW 39CWE-327Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · Low
Fix status
Partial Red Hat: 28 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-327.

Summary

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message authentication, allowing an attacker to forge credentials and gain cluster-wide access. Because the ciphertext is malleable and the monitor will encrypt attacker-chosen entity names, an attacker holding one low-privilege key and able to observe CephX traffic can use the monitor as an encryption oracle and splice ciphertext blocks into valid tickets for privileged entities such as Manager, MDS, and OSD. The same lack of authentication also lets an attacker with CephX permissions escalate privileges by flipping a single bit in a service ticket to set its allow_all field to true. This issue is fixed in versions 20.2.4 and 19.2.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00093 0th percentileScored 2026-11-07
Fix Partial ceph (ceph): 19.2.6, 20.2.4Red Hat: 9 advisoriesRed Hat: 28 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cephcephbefore 19.2.6; 20.0.0 to before 20.2.419.2.6, 20.2.4Patch availableCNA
  • ceph Vendorceph Affected before 19.2.6; 20.0.0 to before 20.2.4 Fixed in 19.2.6, 20.2.4 Patch available CNA

Remediation

  • Fix · CNA ceph (ceph) Fixed in 19.2.6, 20.2.4

Red Hat 9 advisories

  • RHSA-2026:86618 Released 2026-10-21 · Red Hat rating Critical
    New container image: rhceph-9.2
    • Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
  • RHSA-2026:83548 Released 2026-10-15 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
  • RHSA-2026:79243 Released 2026-10-08 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
Show 6 more Red Hat advisories
  • RHSA-2026:79101 Released 2026-10-08 · Red Hat rating Important
    Red Hat Ceph Storage 8.1 security and bug fix updates
    • Red Hat Ceph Storage 8.1 Tools ceph-2:19.2.1-423.el9cp, ceph-base-2:19.2.1-423.el9cp, ceph-common-2:19.2.1-423.el9cp +25
  • RHSA-2026:27708 Released 2026-06-22 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) kernel-tools-libs-devel-5.14.0-570.123.1.el9_6, libperf-5.14.0-570.123.1.el9_6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) kernel-64k-debug-devel-5.14.0-570.123.1.el9_6, kernel-64k-debug-devel-matched-5.14.0-570.123.1.el9_6, kernel-64k-devel-5.14.0-570.123.1.el9_6 +12
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel-5.14.0-570.123.1.el9_6, kernel-64k-5.14.0-570.123.1.el9_6, kernel-64k-core-5.14.0-570.123.1.el9_6 +28
    • Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt-5.14.0-570.123.1.el9_6, kernel-rt-64k-5.14.0-570.123.1.el9_6, kernel-rt-64k-core-5.14.0-570.123.1.el9_6 +21
    • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) kernel-rt-5.14.0-570.123.1.el9_6, kernel-rt-core-5.14.0-570.123.1.el9_6, kernel-rt-debug-5.14.0-570.123.1.el9_6 +11
  • RHSA-2026:27735 Released 2026-06-22 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) kernel-64k-debug-devel-5.14.0-427.132.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.132.1.el9_4, kernel-64k-devel-5.14.0-427.132.1.el9_4 +11
    • Red Hat Enterprise Linux BaseOS E4S (v.9.4) bpftool-7.3.0-427.132.1.el9_4, kernel-5.14.0-427.132.1.el9_4, kernel-64k-5.14.0-427.132.1.el9_4 +29
    • Red Hat Enterprise Linux Real Time E4S (v.9.4) kernel-rt-5.14.0-427.132.1.el9_4, kernel-rt-core-5.14.0-427.132.1.el9_4, kernel-rt-debug-5.14.0-427.132.1.el9_4 +9
    • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4) kernel-rt-5.14.0-427.132.1.el9_4, kernel-rt-core-5.14.0-427.132.1.el9_4, kernel-rt-debug-5.14.0-427.132.1.el9_4 +11
  • RHSA-2026:27731 Released 2026-06-22 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) kernel-64k-debug-devel-6.12.0-55.82.1.el10_0, kernel-64k-debug-devel-matched-6.12.0-55.82.1.el10_0, kernel-64k-devel-6.12.0-55.82.1.el10_0 +12
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel-6.12.0-55.82.1.el10_0, kernel-64k-6.12.0-55.82.1.el10_0, kernel-64k-core-6.12.0-55.82.1.el10_0 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) kernel-tools-libs-devel-6.12.0-55.82.1.el10_0, libperf-6.12.0-55.82.1.el10_0
    • Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt-6.12.0-55.82.1.el10_0, kernel-rt-64k-6.12.0-55.82.1.el10_0, kernel-rt-64k-core-6.12.0-55.82.1.el10_0 +21
    • Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt-6.12.0-55.82.1.el10_0, kernel-rt-core-6.12.0-55.82.1.el10_0, kernel-rt-debug-6.12.0-55.82.1.el10_0 +11
  • RHSA-2026:18587 Released 2026-05-19 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-687.5.1.el9_8, kernel-64k-debug-devel-matched-5.14.0-687.5.1.el9_8, kernel-64k-devel-5.14.0-687.5.1.el9_8 +12
    • Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-687.5.1.el9_8, kernel-64k-5.14.0-687.5.1.el9_8, kernel-64k-core-5.14.0-687.5.1.el9_8 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-687.5.1.el9_8, libperf-5.14.0-687.5.1.el9_8
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-687.5.1.el9_8, kernel-rt-64k-5.14.0-687.5.1.el9_8, kernel-rt-64k-core-5.14.0-687.5.1.el9_8 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-687.5.1.el9_8, kernel-rt-core-5.14.0-687.5.1.el9_8, kernel-rt-debug-5.14.0-687.5.1.el9_8 +9
  • RHSA-2026:18134 Released 2026-05-19 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-211.7.1.el10_2, kernel-64k-debug-devel-matched-6.12.0-211.7.1.el10_2, kernel-64k-devel-6.12.0-211.7.1.el10_2 +12
    • Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-211.7.1.el10_2, kernel-64k-6.12.0-211.7.1.el10_2, kernel-64k-core-6.12.0-211.7.1.el10_2 +29
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-211.7.1.el10_2, libperf-6.12.0-211.7.1.el10_2
    • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-211.7.1.el10_2, kernel-rt-64k-6.12.0-211.7.1.el10_2, kernel-rt-64k-core-6.12.0-211.7.1.el10_2 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-211.7.1.el10_2, kernel-rt-core-6.12.0-211.7.1.el10_2, kernel-rt-debug-6.12.0-211.7.1.el10_2 +9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Ceph Storage 7.1Fixed RHSA-2026:83548
Red Hat Ceph Storage 8.1Fixed RHSA-2026:79243
Red Hat Ceph Storage 8.1 ToolsFixed RHSA-2026:79101
Red Hat Ceph Storage 9.2Fixed RHSA-2026:86618
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:27708
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:18134
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:18587
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:27735
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:27731
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:27708
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:18134
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:18587
Red Hat Enterprise Linux BaseOS E4S (v.9.4)Fixed RHSA-2026:27735
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:27731
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:27708
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:18134
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:18587
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:27731
Red Hat Enterprise Linux Real Time (v. 10)Fixed RHSA-2026:18134
Red Hat Enterprise Linux Real Time (v. 9)Fixed RHSA-2026:18587
Red Hat Enterprise Linux Real Time E4S (v.9.4)Fixed RHSA-2026:27735
Red Hat Enterprise Linux Real Time EUS (v. 10.0)Fixed RHSA-2026:27731
Red Hat Enterprise Linux Real Time EUS (v.9.6)Fixed RHSA-2026:27708
Red Hat Enterprise Linux Real Time for NFV (v. 10)Fixed RHSA-2026:18134
Red Hat Enterprise Linux Real Time for NFV (v. 9)Fixed RHSA-2026:18587
Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)Fixed RHSA-2026:27735
Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)Fixed RHSA-2026:27731
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)Fixed RHSA-2026:27708
Not affected: 5 products
  • Red Hat Ceph Storage 7.1
  • Red Hat Ceph Storage 8.1
  • Red Hat Ceph Storage 9
  • Red Hat Ceph Storage 9.2
  • Red Hat OpenStack Platform 18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-30156
  2. 2026-10-09 Fix available: RHSA-2026:79101 · Red Hat
  3. 2026-10-09 Fix available: RHSA-2026:79243 · Red Hat
  4. 2026-10-09 Fix available: Red Hat Ceph Storage 8.1, Red Hat Ceph Storage 8.1 Tools · Red Hat
  5. 2026-10-16 Fix available: RHSA-2026:83548 · Red Hat
  6. 2026-10-16 Fix available: Red Hat Ceph Storage 7.1 · Red Hat
  7. 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
  8. 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat

References

Other 3

  • TI-2024-32613 Ceph is vulnerable to authentication bypass through RadosGW CVSS 3.1HIGH 8.1
  • TI-2024-32120 RGW DoS attack with empty HTTP header in S3 object copy CVSS 3.1HIGH 7.5
  • TI-2026-36920 Improper authorization in ceph CVSS 3.1CRITICAL 9.1
  • TI-2020-01660 Hard-coded credentials in ceph-ansible CVSS 3.1HIGH 8.8
  • TI-2018-07675 Improper authorization in Red Hat ceph CVSS 3.0HIGH 8.1
  • TI-2026-28807 Ceph: CephX AES Authentication error CVSS 3.1HIGH 8.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences