Refine your search
9 vulnerabilities found for ceph by ceph
CVE-2026-54330 (GCVE-0-2026-54330)
Vulnerability from cvelistv5
Published
2026-08-27 20:59
Modified
2026-08-28 15:57
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Summary
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL's signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T15:45:40.069617Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T15:57:33.424Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ceph",
"vendor": "ceph",
"versions": [
{
"status": "affected",
"version": "\u003e= 19.0.0, \u003c 19.2.6"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-* header on a SigV4 request to be signed and rejects requests bearing additional unsigned headers, but RGW validates only the headers listed in X-Amz-SignedHeaders and ignores any extra ones, so they take effect without being covered by the signature. By adding such headers to a presigned PUT URL, an attacker can grant themselves more capabilities than the URL\u0027s signer intended and escalate their privileges. This issue is fixed in versions 20.2.4 and 19.2.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T20:59:24.688Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ceph/ceph/security/advisories/GHSA-rmjq-ffrm-j6vj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ceph/ceph/security/advisories/GHSA-rmjq-ffrm-j6vj"
},
{
"name": "https://github.com/ceph/ceph/commit/5837aa8e60471128dbb672b0ff6f1b1feebe08a7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ceph/ceph/commit/5837aa8e60471128dbb672b0ff6f1b1feebe08a7"
},
{
"name": "https://github.com/ceph/ceph/commit/5978c866d4a0812fbb024745c4f1e79aaecd6c6a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ceph/ceph/commit/5978c866d4a0812fbb024745c4f1e79aaecd6c6a"
}
],
"source": {
"advisory": "GHSA-rmjq-ffrm-j6vj",
"discovery": "UNKNOWN"
},
"title": "Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54330",
"datePublished": "2026-08-27T20:59:24.688Z",
"dateReserved": "2026-06-12T18:42:02.224Z",
"dateUpdated": "2026-08-28T15:57:33.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50152 (GCVE-0-2026-50152)
Vulnerability from cvelistv5
Published
2026-08-27 20:53
Modified
2026-08-28 15:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-285 - Improper Authorization
Summary
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T15:06:07.202404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T15:06:15.096Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ceph",
"vendor": "ceph",
"versions": [
{
"status": "affected",
"version": "\u003e= 19.0.0, \u003c 19.2.6"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only \u00a0`mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T20:53:42.353Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ceph/ceph/security/advisories/GHSA-rg9p-5xcp-wm8h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ceph/ceph/security/advisories/GHSA-rg9p-5xcp-wm8h"
},
{
"name": "https://github.com/ceph/ceph/commit/d971bb2b6199f70b1708a20a63fa944ee7a94727",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ceph/ceph/commit/d971bb2b6199f70b1708a20a63fa944ee7a94727"
},
{
"name": "https://github.com/ceph/ceph/commit/f2840d2fd338ab5de2865f0f78684bbf7b888c84",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ceph/ceph/commit/f2840d2fd338ab5de2865f0f78684bbf7b888c84"
}
],
"source": {
"advisory": "GHSA-rg9p-5xcp-wm8h",
"discovery": "UNKNOWN"
},
"title": "Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50152",
"datePublished": "2026-08-27T20:53:42.353Z",
"dateReserved": "2026-06-03T20:54:20.431Z",
"dateUpdated": "2026-08-28T15:06:15.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-39944 (GCVE-0-2026-39944)
Vulnerability from cvelistv5
Published
2026-08-27 20:47
Modified
2026-08-28 15:57
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
Summary
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway (RGW) protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid STS token to tamper with it undetected and escalate to full RGW administrative access. Because the ciphertext is unauthenticated, the attacker can perform a CBC bit-flip on the acct_type, perm_type, and is_admin fields of their own token, and a forged is_admin value triggers a global administrative override that bypasses all capability checks. The attack is reachable remotely over the RGW S3 endpoint and is a self-contained modification of a token the attacker already possesses, requiring no encryption oracle and no network observation. It requires only a single valid STS token, which need not carry any elevated privileges, with STS enabled. This issue is fixed in versions 20.2.4 and 19.2.6.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-39944",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T15:45:42.373340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T15:57:39.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ceph",
"vendor": "ceph",
"versions": [
{
"status": "affected",
"version": "\u003e= 19.0.0, \u003c 19.2.6"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway (RGW) protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid STS token to tamper with it undetected and escalate to full RGW administrative access. Because the ciphertext is unauthenticated, the attacker can perform a CBC bit-flip on the acct_type, perm_type, and is_admin fields of their own token, and a forged is_admin value triggers a global administrative override that bypasses all capability checks. The attack is reachable remotely over the RGW S3 endpoint and is a self-contained modification of a token the attacker already possesses, requiring no encryption oracle and no network observation. It requires only a single valid STS token, which need not carry any elevated privileges, with STS enabled. This issue is fixed in versions 20.2.4 and 19.2.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-327",
"description": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T20:47:01.512Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ceph/ceph/security/advisories/GHSA-j73r-qrgx-jvq2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ceph/ceph/security/advisories/GHSA-j73r-qrgx-jvq2"
},
{
"name": "https://github.com/ceph/ceph/releases/tag/v19.2.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ceph/ceph/releases/tag/v19.2.6"
},
{
"name": "https://github.com/ceph/ceph/releases/tag/v20.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ceph/ceph/releases/tag/v20.2.4"
}
],
"source": {
"advisory": "GHSA-j73r-qrgx-jvq2",
"discovery": "UNKNOWN"
},
"title": "Ceph: CephX AES Authentication error"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-39944",
"datePublished": "2026-08-27T20:47:01.512Z",
"dateReserved": "2026-04-07T22:40:33.820Z",
"dateUpdated": "2026-08-28T15:57:39.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-30156 (GCVE-0-2025-30156)
Vulnerability from cvelistv5
Published
2026-08-27 20:34
Modified
2026-08-27 20:34
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
Summary
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message authentication, allowing an attacker to forge credentials and gain cluster-wide access. Because the ciphertext is malleable and the monitor will encrypt attacker-chosen entity names, an attacker holding one low-privilege key and able to observe CephX traffic can use the monitor as an encryption oracle and splice ciphertext blocks into valid tickets for privileged entities such as Manager, MDS, and OSD. The same lack of authentication also lets an attacker with CephX permissions escalate privileges by flipping a single bit in a service ticket to set its allow_all field to true. This issue is fixed in versions 20.2.4 and 19.2.6.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "ceph",
"vendor": "ceph",
"versions": [
{
"status": "affected",
"version": "\u003c 19.2.6"
},
{
"status": "affected",
"version": "\u003e= 20.0.0, \u003c 20.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message authentication, allowing an attacker to forge credentials and gain cluster-wide access. Because the ciphertext is malleable and the monitor will encrypt attacker-chosen entity names, an attacker holding one low-privilege key and able to observe CephX traffic can use the monitor as an encryption oracle and splice ciphertext blocks into valid tickets for privileged entities such as Manager, MDS, and OSD. The same lack of authentication also lets an attacker with CephX permissions escalate privileges by flipping a single bit in a service ticket to set its allow_all field to true. This issue is fixed in versions 20.2.4 and 19.2.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-327",
"description": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T20:34:41.822Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ceph/ceph/security/advisories/GHSA-7q3q-3975-qw3q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ceph/ceph/security/advisories/GHSA-7q3q-3975-qw3q"
},
{
"name": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f"
},
{
"name": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6"
}
],
"source": {
"advisory": "GHSA-7q3q-3975-qw3q",
"discovery": "UNKNOWN"
},
"title": "Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-30156",
"datePublished": "2026-08-27T20:34:41.822Z",
"dateReserved": "2025-03-17T12:41:42.566Z",
"dateUpdated": "2026-08-27T20:34:41.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-47866 (GCVE-0-2024-47866)
Vulnerability from cvelistv5
Published
2025-11-12 18:28
Modified
2025-12-11 15:35
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-20 - Improper Input Validation
Summary
Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-12T19:03:51.423Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/11/11/3"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47866",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-11T15:29:41.208745Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-11T15:35:30.968Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ceph",
"vendor": "ceph",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-12T18:28:18.545Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8"
}
],
"source": {
"advisory": "GHSA-mgrm-g92q-f8h8",
"discovery": "UNKNOWN"
},
"title": "RGW DoS attack with empty HTTP header in S3 object copy"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-47866",
"datePublished": "2025-11-12T18:28:18.545Z",
"dateReserved": "2024-10-04T16:00:09.628Z",
"dateUpdated": "2025-12-11T15:35:30.968Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-48916 (GCVE-0-2024-48916)
Vulnerability from cvelistv5
Published
2025-07-30 19:45
Modified
2025-07-30 19:54
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Summary
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-48916",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-30T19:54:31.667804Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-30T19:54:42.022Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ceph",
"vendor": "ceph",
"versions": [
{
"status": "affected",
"version": "\u003c= 19.2.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has \"none\" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-30T19:45:00.454Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ceph/ceph/security/advisories/GHSA-5g9m-mmp6-93mq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ceph/ceph/security/advisories/GHSA-5g9m-mmp6-93mq"
}
],
"source": {
"advisory": "GHSA-5g9m-mmp6-93mq",
"discovery": "UNKNOWN"
},
"title": "Ceph is vulnerable to authentication bypass through RadosGW"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-48916",
"datePublished": "2025-07-30T19:45:00.454Z",
"dateReserved": "2024-10-09T22:06:46.172Z",
"dateUpdated": "2025-07-30T19:54:42.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-52555 (GCVE-0-2025-52555)
Vulnerability from cvelistv5
Published
2025-06-26 20:21
Modified
2025-11-03 18:13
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-269 - Improper Privilege Management
Summary
Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is that a user could read, write and execute to any directory owned by root as long as they chmod 777 it. This impacts confidentiality, integrity, and availability. It is patched in versions 17.2.8, 18.2.5, and 19.2.3.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-52555",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T20:40:04.617328Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T20:40:18.751Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T18:13:06.474Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00025.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ceph",
"vendor": "ceph",
"versions": [
{
"status": "affected",
"version": "= 17.2.7"
},
{
"status": "affected",
"version": "\u003e= 18.2.1, \u003c 18.2.5"
},
{
"status": "affected",
"version": "\u003e= 19.0.0, \u003c 19.2.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is that a user could read, write and execute to any directory owned by root as long as they chmod 777 it. This impacts confidentiality, integrity, and availability. It is patched in versions 17.2.8, 18.2.5, and 19.2.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T20:21:05.594Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ceph/ceph/security/advisories/GHSA-89hm-qq33-2fjm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ceph/ceph/security/advisories/GHSA-89hm-qq33-2fjm"
},
{
"name": "https://github.com/ceph/ceph/pull/60314",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ceph/ceph/pull/60314"
}
],
"source": {
"advisory": "GHSA-89hm-qq33-2fjm",
"discovery": "UNKNOWN"
},
"title": "CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-52555",
"datePublished": "2025-06-26T20:21:05.594Z",
"dateReserved": "2025-06-18T03:55:52.034Z",
"dateUpdated": "2025-11-03T18:13:06.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CERTFR-2026-AVI-1057
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Ceph. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Ceph versions ant\u00e9rieures \u00e0 19.2.6",
"product": {
"name": "Ceph",
"vendor": {
"name": "Ceph",
"scada": false
}
}
},
{
"description": "Ceph versions 20.2.x ant\u00e9rieures \u00e0 20.2.4",
"product": {
"name": "Ceph",
"vendor": {
"name": "Ceph",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-39944",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39944"
},
{
"name": "CVE-2026-54330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54330"
},
{
"name": "CVE-2025-30156",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30156"
},
{
"name": "CVE-2026-50152",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50152"
}
],
"initial_release_date": "2026-08-20T00:00:00",
"last_revision_date": "2026-08-20T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1057",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-20T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ceph. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Ceph",
"vendor_advisories": [
{
"published_at": "2026-08-19",
"title": "Bulletin de s\u00e9curit\u00e9 Ceph GHSA-rmjq-ffrm-j6vj",
"url": "https://github.com/ceph/ceph/security/advisories/GHSA-rmjq-ffrm-j6vj"
},
{
"published_at": "2026-08-19",
"title": "Bulletin de s\u00e9curit\u00e9 Ceph GHSA-rg9p-5xcp-wm8h",
"url": "https://github.com/ceph/ceph/security/advisories/GHSA-rg9p-5xcp-wm8h"
},
{
"published_at": "2026-08-19",
"title": "Bulletin de s\u00e9curit\u00e9 Ceph GHSA-j73r-qrgx-jvq2",
"url": "https://github.com/ceph/ceph/security/advisories/GHSA-j73r-qrgx-jvq2"
},
{
"published_at": "2026-08-19",
"title": "Bulletin de s\u00e9curit\u00e9 Ceph GHSA-7q3q-3975-qw3q",
"url": "https://github.com/ceph/ceph/security/advisories/GHSA-7q3q-3975-qw3q"
}
]
}
CERTFR-2026-AVI-0078
Vulnerability from certfr_avis
Une vulnérabilité a été découverte dans Ceph. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Ceph versions 19.x ant\u00e9rieures \u00e0 19.2.4",
"product": {
"name": "Ceph",
"vendor": {
"name": "Ceph",
"scada": false
}
}
},
{
"description": "Ceph versions 20.x ant\u00e9rieures \u00e0 20.2.1",
"product": {
"name": "Ceph",
"vendor": {
"name": "Ceph",
"scada": false
}
}
},
{
"description": "Ceph versions ant\u00e9rieures \u00e0 18.2.9",
"product": {
"name": "Ceph",
"vendor": {
"name": "Ceph",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-31884",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-31884"
}
],
"initial_release_date": "2026-01-22T00:00:00",
"last_revision_date": "2026-01-22T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0078",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-01-22T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Ceph. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Vuln\u00e9rabilit\u00e9 dans Ceph",
"vendor_advisories": [
{
"published_at": "2026-01-21",
"title": "Bulletin de s\u00e9curit\u00e9 Ceph GHSA-xj9f-7g59-m4jx",
"url": "https://github.com/ceph/ceph/security/advisories/GHSA-xj9f-7g59-m4jx"
}
]
}