https://seclists.org/oss-sec/2026/q3/518: Ceph 20.2.4 and Ceph 19.2.6 aleased with 4 security fixes.
Published Aug 19, 2026
·Updated
Affected Software
1 affected component
ceph Ceph
The attacker needs compromised credentials on the Ceph network. No user interaction is required.
An attacker could observe ciphertext patterns to infer plaintext and modify ciphertext without detection. This could include expanding the scope of their own credentials, affecting confidentiality and integrity; availability impact is described as low.
Ceph replaced the unauthenticated AES-CBC implementation and hardcoded initialization vector with AES-256-CTS-HMAC-SHA384-192. The change required substantial changes across userspace components.