https://seclists.org/oss-sec/2026/q3/518: Ceph 20.2.4 and Ceph 19.2.6 aleased with 4 security fixes.
Published Aug 19, 2026
·Updated
Affected Software
1 affected component
ceph Ceph
Frequently Asked Questions
1
What access does an attacker need to exploit the CephX cryptographic flaw?
The attacker needs compromised credentials on the Ceph network. No user interaction is required.
2
What could an attacker do with this issue?
An attacker could observe ciphertext patterns to infer plaintext and modify ciphertext without detection. This could include expanding the scope of their own credentials, affecting confidentiality and integrity; availability impact is described as low.
3
What remediation is included in the released updates?
Ceph replaced the unauthenticated AES-CBC implementation and hardcoded initialization vector with AES-256-CTS-HMAC-SHA384-192. The change required substantial changes across userspace components.