Updated packages are now available for Ceph Upstream Tentacle (v20.2.4) and Squid (v19.2.6). These releases resolve several security vulnerabilities within the Ceph core.
These issues were identified during internal security audits by CLYSO engineers David Mohren, among others, and addressed in close collaboration with the upstream Ceph community.
Upstream Release Notes:
Resolved Vulnerabilities
CVE-2025-30156 (CephX Service Tickets | CVSS 7.9):
Applies to all Ceph versions. An actor holding a valid CephX key who can reach the Ceph public network could escalate their permissions within the cluster.
Assessment: If all CephX keys in your environment are kept strictly on your own admin systems or controlled infrastructure, there is no immediate exposure. If you issue keys to tenants, shared platforms, or end-user devices, applying this update should be prioritized.CVE-2026-39944 (RGW STS Session Tokens | CVSS 8.5):
Affects setups using RGW STS. Important note: Upgrading packages does not automatically migrate existing STS tokens. Admins must manually migrate all active STS tokens to the new crypto standard or disable STS via rgw_s3_auth_use_sts = false.CVE-2026-50152 (Monitor Config-Key Store | CVSS 8.7):
Fixes an insufficient authorization check in the monitor configuration store that could allow read access to restricted areas.CVE-2026-54330 (RGW SigV4 Verification | CVSS 8.2):
Corrects signature verification for presigned URLs in the Object Gateway. Relevant for environments that issue presigned URLs to external or untrusted parties.
Assessing Your Exposure
Do you use RGW STS in your cluster?
Temporarily disable RGW STS (rgw_s3_auth_use_sts = false) until the update is applied and all tokens are migrated.Is the Ceph public network reachable from untrusted networks or clients?
Yes: Action required – Schedule the update and key rotation promptly.
No: No imminent threat – Perform the update during your standard maintenance window.
Release Status
Ceph Tentacle: Version
v20.2.4(Available)Ceph Squid: Version
v19.2.6(Available)Older Releases (Reef, Quincy & older): Upgrading to current releases recommended. Backports are under evaluation; a server-side fallback patch is currently in testing.
Post-Upgrade Expectations
The CephX fix introduces the aes256k cipher standard alongside the older aes method. Following the package upgrade, clusters running authentication health checks will initially report a HEALTH_ERR. This is expected behavior and will remain until post-upgrade key rotation is completed.
Orchestration via Cephadm / Rook: Both orchestrators automate internal service key rotation during the upgrade process. Note that only Rook currently supports automatic client key rotation.
Backward Compatibility: Cephadm and Rook retain the previous encryption cipher as an allowed fallback option. Existing client connections will not be disrupted during the upgrade. If legacy clients must be supported for the time being, the associated health warnings can be silenced in the cluster.
RGW STS Tokens: If you use RGW STS, note that Ceph does not issue warnings for legacy tokens after upgrading. Existing tokens must be manually migrated to the new crypto standard.
Note on Earlier Ceph Releases (Reef, Quincy & Older):
Upgrading to the latest patched releases remains the safest and primary recommendation. For environments that cannot be upgraded immediately or are bound to earlier releases, our engineering team is actively evaluating tailored mitigation options and backport feasibility.
If your cluster is exposed and an immediate upgrade is not feasible, please reach out to our consulting team at support@clyso.com.
Documentation & Support
For deeper technical documentation and details regarding these security advisories, please refer directly to the official Ceph Project Blog.
If you have questions about upgrading, rotating keys, or assessing your environment, our consulting team is available to assist at support@clyso.com.