Ceph patches CephX auth bypass and Monitor key-store leak

The Ceph project has shipped Tentacle 20.2.4 and Squid 19.2.6 with four security fixes, led by a high-severity authentication bypass in CephX and an improper-authorization flaw in the Monitor config-key store.

CVE-2025-30156 (CVSS 8.9) stems from CephX using AES-CBC without authentication and with a hardcoded initialization vector. Identical plaintexts therefore produced identical ciphertexts. An attacker who already held any compromised credentials on the Ceph network could infer plaintext from ciphertext patterns and flip bits to alter data undetected, including expanding the scope of their own credentials. No user interaction is required. Ceph replaced AES-CBC with AES-256-CTS-HMAC-SHA384-192, a change that touched userspace daemons and built on upstream Linux kernel work. The issue was reported by Erin Shepherd of e43.eu and later found independently by researchers at CLYSO and Ada Logics.

CVE-2026-50152 (CVSS 8.2) is an authorization failure in the Monitor subscription handler. Any CephX principal with mon allow r capabilities could read the entire Monitor config-key store via a crafted subscribe message. That store can hold OSD LUKS passphrases and, on cephadm-managed clusters, the SSH private key cephadm uses to reach every host, which under default configuration yields root access. The attacker needs cluster access and a compromised account with those Monitor read rights.

Operators running affected releases should upgrade promptly, especially where mon allow r is granted broadly or cephadm manages the fleet.