Ceph vulnerabilities

Products

• Ceph 34
• Ceph-ansible 2
• Ceph-deploy 2

Newest

• ceph Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation CVE-2026-54330 Fix available 8.1 HighAugust 27, 2026
• ceph Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users CVE-2026-50152 Fix available 9.1 CriticalAugust 27, 2026
• ceph Ceph: CephX AES Authentication error CVE-2026-39944 Fix available 8.8 HighAugust 27, 2026
• ceph Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery CVE-2025-30156 Fix available 8.9 HighMay 19, 2026
• ceph RGW DoS attack with empty HTTP header in S3 object copy CVE-2024-47866 Fix available 7.5 HighNovember 12, 2025
• ceph CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS CVE-2025-52555 Fix available 6.5 MediumJune 26, 2025
• ceph Ceph is vulnerable to authentication bypass through RadosGW CVE-2024-48916 Fix available 8.1 HighDecember 3, 2024
• ceph, redhat ceph storage +1 more A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit... CVE-2022-3854 Fix available 6.5 MediumMarch 6, 2023
• ceph A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to... CVE-2022-3650 Fix available 7.8 HighDecember 30, 2022
• ceph, fedoraproject fedora, redhat ceph storage +2 more A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner... CVE-2022-0670 Fix available 9.1 CriticalJuly 25, 2022
• ceph, redhat ceph storage, fedoraproject fedora +5 more +7 more A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the... CVE-2021-3979 Fix available 6.5 MediumFebruary 19, 2022
• ceph, redhat ceph storage, fedoraproject fedora +2 more A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a... CVE-2021-3531 Fix available 5.3 MediumMay 18, 2021
• ceph, redhat ceph storage, debian linux +1 more +3 more A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14... CVE-2021-3524 Fix available 6.5 MediumMay 17, 2021
• ceph, debian linux, fedoraproject fedora +1 more +3 more An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles... CVE-2021-20288 Fix available 7.2 HighApril 15, 2021
• ceph, fedoraproject fedora, redhat ceph storage +2 more A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in... CVE-2020-25678 Fix available 4.4 MediumJanuary 8, 2021
• ceph, fedoraproject fedora, redhat ceph storage +2 more +4 more User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila,... CVE-2020-27781 Fix available 7.1 HighDecember 18, 2020
• ceph ceph-ansible, redhat ceph storage +1 more Ceph-ansible 4.0.34.1 creates /etc/ceph/iscsi-gateway.conf with insecure default permissions,... CVE-2020-25677 Fix available 5.5 MediumDecember 8, 2020
• ceph, fedoraproject fedora, redhat ceph storage +1 more +3 more A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2... CVE-2020-25660 Fix available 8.8 HighNovember 20, 2020
• [unknown] ceph An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the... CVE-2020-10736 Fix available 8.0 HighJune 22, 2020
• ceph ceph-ansible A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were... CVE-2020-1716 Fix available 8.8 HighMay 19, 2020
• [unknown] ceph, canonical ubuntu linux, debian linux +3 more +5 more A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user... CVE-2020-1760 Fix available 5.8 MediumApril 6, 2020
• ceph, redhat ceph storage, openshift +2 more +4 more A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2... CVE-2020-1759 Fix available 6.4 MediumApril 6, 2020
• ceph, redhat ceph storage +1 more A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5,... CVE-2020-1699 Fix available 7.5 HighJanuary 31, 2020
• [unknown] ceph, canonical ubuntu linux, opensuse leap +1 more +3 more A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An... CVE-2020-1700 Fix available 6.5 MediumJanuary 31, 2020
• ceph, fedoraproject fedora, redhat ceph storage +2 more A flaw was found in the Ceph RGW configuration with Beast as the front end handling client... CVE-2019-10222 Fix available 7.5 HighAugust 28, 2019
• [unknown] ceph, ceph civetweb, canonical ubuntu linux +2 more A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL... CVE-2019-3821 Fix available 7.5 HighMarch 27, 2019
• ceph Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the... CVE-2018-16889 Fix available 5.5 MediumJanuary 28, 2019
• [unknown] ceph, canonical ubuntu linux, debian linux +3 more +5 more It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial... CVE-2018-16846 Fix available 6.5 MediumJanuary 15, 2019
• [unknown] ceph, canonical ubuntu linux, debian linux +3 more +5 more It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions... CVE-2018-14662 Fix available 3.5 LowJanuary 15, 2019
• ceph, debian linux, opensuse leap +7 more +9 more A flaw was found in the way signature calculation was handled by cephx authentication protocol.... CVE-2018-1129 Fix available 6.5 MediumJuly 10, 2018
• ceph, debian linux, opensuse leap +7 more +9 more It was found that cephx authentication protocol did not verify ceph clients correctly and was... CVE-2018-1128 Fix available 7.5 HighJuly 10, 2018
• ceph, redhat ceph storage, debian linux +6 more +8 more A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having... CVE-2018-10861 Fix available 8.1 HighJuly 10, 2018
• [unknown] openstack-tripleo-heat-templates, ceph +1 more Openstack tripleo-heat-templates unauthenticated file access CVE-2017-12155 Fix available 6.3 MediumDecember 12, 2017
• [unknown] ceph, debian linux +1 more In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user... CVE-2017-7519 Fix available 2.3 LowNovember 2, 2017
• ceph, redhat ceph storage, ceph storage mon +4 more +6 more A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the... CVE-2016-9579 Fix available 6.5 MediumDecember 12, 2016
• ceph, redhat enterprise linux desktop, enterprise linux server +1 more +3 more A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object... CVE-2016-8626 Fix available 6.5 MediumOctober 28, 2016
• ceph ceph-deploy ceph-deploy uses world-readable permissions on client.admin key CVE-2015-4053 Fix available 2.1 LowJune 8, 2015
• ceph ceph-deploy ceph-deploy allows local users to obtain sensitive information by reading the file CVE-2015-3010 Fix available 2.1 LowMay 31, 2015