Ceph vulnerabilities
We track 8 vulnerabilities in Ceph products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on August 28, 2026.
Latest Ceph vulnerabilities
- 8.1 High severity
ceph: Improper Verification of Cryptographic Signature
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header
- 9.1 Critical severity
ceph: Improper Authorization
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user w
- 8.8 High severity
ceph: Use of a Broken or Risky Cryptographic Algorithm
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway (RGW) protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allo
- 8.9 High severity
ceph: Use of a Broken or Risky Cryptographic Algorithm
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initial
- 7.5 High severity
Ceph is a distributed object, block, and file storage platform.
Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS a
- 8.1 High severity
ceph: Insufficient Verification of Data Authenticity
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provi
- 7.8 High severity
Ceph: Placement of User into Incorrect Group
A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information.
- 9.1 Critical severity
Ceph: Incorrect Authorization
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compro