- ceph-users - lists.ceph.io

Re: [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released
by Maximilian Stinsky-Damke 20 Aug '26

20 Aug '26

I linked the wrong documentation regarding the ceph orch daemon rotate-key command, here is the correct link for the command that does not work in 19.2.x: https://docs.ceph.com/en/squid/cephadm/operations/#rotating-a-daemon-s-auth… Best Regards ________________________________ From: Maximilian Stinsky-Damke <ceph-users(a)ceph.io> Sent: 20 August 2026 13:00 To: ceph-users <ceph-users(a)ceph.io> Subject: [ceph-users] Re: [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released Warning: This email is from an unusual correspondent. Warning: Make sure this is someone you trust. Hi, I upgraded a test cluster to Ceph Squid 19.2.6 via cephadm. The following cephadm managed client keys were not rotated automatically: client.bootstrap-* (bootstrap-rgw, bootstrap-osd, ...) client.ceph-exporter. client.crash. client.osd-lockbox.. client.rgw. The Squid docs mention ceph orch daemon rotate-key <name>, but in 19.2.* this command does not exist. https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Fsquid%2F… https://urlsand.esvalabs.com/?u=https%3A%2F%2Fgithub.com%2Fceph%2Fceph%2Fbl… What is the correct way to rotate these client keys via cephadm as part of the cve fix? Thanks for any guidance. Best Regards Max ________________________________ From: Patrick Donnelly <ceph-users(a)ceph.io> Sent: 19 August 2026 18:08 To: ceph-users <ceph-users(a)ceph.io> Subject: [ceph-users] [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released Warning: This email is from an unusual correspondent. Warning: Make sure this is someone you trust. Today, August 19th, 2026, the Ceph project has released Tentacle 20.2.4 and Squid 19.2.6 hotfixes for four CVEs across several components. This is the sixth backport release in the Squid series. This is the fourth backport release in the Tentacle series. Additional details will be posted on the Ceph website/blog: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fceph.io%2Fen%2Fnews%2Fblog%2F… We strongly recommend that all Ceph operators upgrade to one of these releases as soon as possible. ## Critical Upgrade Steps The fix for CVE-2025-30156 introduces a new CephX key type, aes256k. This is the first time Ceph has introduced a new key type for CephX credentials. Therefore, a new procedure exists for upgrading and rotating Ceph daemon keys as part of this CVE. Before upgrading a Ceph cluster, the operator should familiarize themselves with the procedure documented at: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… These steps are for package-based deployments of Ceph. In other sections, the document also includes new information about key rotation procedures, monitor authentication controls, and emergency recovery procedures. Deployments using cephadm will automate the process except for client keys. You may notice that Cephadm spends more time than normal on the upgrade after updating all daemon images. This is due to a new process rotating the OSD and MDS keys. Please be patient. There are plans to improve this in the future. Deployments using Rook will also automate rotation of some client keys with some exclusions. Look to the Rook project’s announcement for more details. Client and kernel upgrades are recommended to support aes256k. Note that upstream Linux kernel client support began in kernel 7.0 and has been backported to CentOS Stream 9 and 10. Check with your distribution vendor for backported key support before rotating client keys used by the kernel. As part of upgrading a Ceph cluster, six new health warnings and errors will be generated. This is normal. As part of the process to upgrade/rotate entity keys, you will address the warnings and errors as you go. These are documented beginning here: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… The CephX documentation has been brought up to date and vetted for accuracy. Those changes are live here: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… Regarding the fix for CVE-2026-54330, RGW will now reject Sigv4 requests with `host` and `x-amz-` headers not included in the signed subset. Unfortunately, the REST client used in multisite was generating such improperly signed requests. If you are running multisite, you must set the ``rgw_sigv4_insecure`` option to true before you begin to upgrade. After all clusters are upgraded, set the option to ``false`` again. Regarding the fix for CVE-2026-50152, formal guidance on rotating all secrets stored in the Monitor config-key store will be forthcoming. In the meantime, operators of cephadm-managed clusters are strongly encouraged to rotate the cephadm SSH key, as an established process exists: See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… Rotating other secrets is advised but the process is not yet established. Operators should assess their cluster's potential exposure to determine if immediate Monitor config-key secret rotation is required for their environment. ## CVE Fixes * CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC. See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… * CVE-2026-39944 shares the unauthenticated-encryption root cause of CVE-2025-30156, but applies it to RGW's STS session tokens resulting in improper verification of a cryptographic signature. See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… * CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor subscription handler. See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… * CVE-2026-54330 is a flaw in RGW not properly verifying its SigV4 cryptographic signatures in RGW's SigV4 verifier. See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… ## Other Media A Cephalocon 2025 talk covers some of the details surrounding the new CephX key upgrade process. https://urlsand.esvalabs.com/?u=https%3A%2F%2Fcephalocon2025.sched.com%2Fev… ## Getting Ceph ------------ * Source at https://urlsand.esvalabs.com/?u=https%3A%2F%2Fgithub.com%2Fceph%2Fceph&e=50… * v19.2.6 Tarball at https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdownload.ceph.com%2Ftarballs%… * v20.2.4 Tarball at https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdownload.ceph.com%2Ftarballs%… * Containers at https://urlsand.esvalabs.com/?u=https%3A%2F%2Fquay.io%2Frepository%2Fceph%2… * For packages, see https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… * For upgrade with cephadm, see: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… * v19.2.6 Release git sha1: f9fd95b4335bad6a26d7a74468f55d269e8dbef4 * v20.2.4 Release git sha1: 7f793731f1b39eb4f465e960113d2363c311b964 -- Patrick Donnelly, Ph.D. He / Him / His Red Hat Partner Engineer IBM, Inc. GPG: 19F28A586F808C2402351B93C3301A3E258DD79D _______________________________________________ ceph-users mailing list -- ceph-users(a)ceph.io To unsubscribe send an email to ceph-users-leave(a)ceph.io -- This message has been checked by Libraesva ESG and is found to be clean. Follow this link to report as spam/bad: https://mx10.wiit.cloud/action/4hQBLz2RJPzTh0J/report-as-bad Follow this link to blocklist sender: https://mx10.wiit.cloud/action/4hQBLz2RJPzTh0J/blocklist _______________________________________________ ceph-users mailing list -- ceph-users(a)ceph.io To unsubscribe send an email to ceph-users-leave(a)ceph.io -- This message has been checked by Libraesva ESG and is found to be clean. Follow this link to report as spam/bad: https://mx10.wiit.cloud/action/4hQgT36zpCzTkgH/report-as-bad Follow this link to blocklist sender: https://mx10.wiit.cloud/action/4hQgT36zpCzTkgH/blocklist

1 0

Re: [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released
by Pedro Macedo 20 Aug '26

20 Aug '26

On 2026-08-20 10:32 AM, Iztok Gregori wrote: > Hi! > > Silly question maybe, but I want to be sure, for RBD clients (Proxmox > QEMU virtual machines in my case) the new key type needs updated > "client libraries" to be "understood", right? Seems to be the case, according to the presentation that talked about the cephx rotation when it was added ( title "Rotating Heads and CephX Keys - Patrick Donnelly, IBM & Yehuda Sadeh Weinraub, Ubiquiti" on youtube; not including link in case it gets blocked. Relevant bit is at 19:50). Quote from the slide: "Old userspace clients will crash if you attempt to use a new key type!". And while I haven't tested libvirt against 20.2.4 yet, the new key type breaks cephfs mounts on Debian stable (which has ceph-common @ 18.2.7) with an error about parsing the keyring file. -- Pedro Macedo > > Cheers > Iztok > > On 19/08/26 18:07, Patrick Donnelly wrote: >> Today, August 19th, 2026, the Ceph project has released Tentacle >> 20.2.4 and Squid 19.2.6 hotfixes for four CVEs across several >> components. >> >> This is the sixth backport release in the Squid series. >> >> This is the fourth backport release in the Tentacle series. >> >> Additional details will be posted on the Ceph website/blog: >> https://ceph.io/en/news/blog/ >> >> We strongly recommend that all Ceph operators upgrade to one of these >> releases as soon as possible. >> >> >> ## Critical Upgrade Steps >> >> The fix for CVE-2025-30156 introduces a new CephX key type, aes256k. >> This is the first time Ceph has introduced a new key type for CephX >> credentials. Therefore, a new procedure exists for upgrading and >> rotating Ceph daemon keys as part of this CVE. Before upgrading a Ceph >> cluster, the operator should familiarize themselves with the procedure >> documented at: >> >> https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.h… >> >> >> These steps are for package-based deployments of Ceph. In other >> sections, the document also includes new information about key >> rotation procedures, monitor authentication controls, and emergency >> recovery procedures. >> >> Deployments using cephadm will automate the process except for client >> keys. You may notice that Cephadm spends more time than normal on the >> upgrade after updating all daemon images. This is due to a new process >> rotating the OSD and MDS keys. Please be patient. There are plans to >> improve this in the future. >> >> Deployments using Rook will also automate rotation of some client keys >> with some exclusions. Look to the Rook project’s announcement for more >> details. >> >> Client and kernel upgrades are recommended to support aes256k. Note >> that upstream Linux kernel client support began in kernel 7.0 and has >> been backported to CentOS Stream 9 and 10. Check with your >> distribution vendor for backported key support before rotating client >> keys used by the kernel. >> >> As part of upgrading a Ceph cluster, six new health warnings and >> errors will be generated. This is normal. As part of the process to >> upgrade/rotate entity keys, you will address the warnings and errors >> as you go. These are documented beginning here: >> >> https://docs.ceph.com/en/latest/rados/operations/health-checks/index.html#a… >> >> >> The CephX documentation has been brought up to date and vetted for >> accuracy. Those changes are live here: >> >> https://docs.ceph.com/en/latest/architecture/index.html#high-availability-a… >> >> >> Regarding the fix for CVE-2026-54330, RGW will now reject Sigv4 >> requests with `host` and `x-amz-` headers not included in the signed >> subset. Unfortunately, the REST client used in multisite was >> generating such improperly signed requests. >> >> If you are running multisite, you must set the ``rgw_sigv4_insecure`` >> option to true before you begin to upgrade. After all clusters are >> upgraded, set the option to ``false`` again. >> >> Regarding the fix for CVE-2026-50152, formal guidance on rotating all >> secrets stored in the Monitor config-key store will be forthcoming. In >> the meantime, operators of cephadm-managed clusters are strongly >> encouraged to rotate the cephadm SSH key, as an established process >> exists: >> >> See: >> https://docs.ceph.com/en/latest/cephadm/host-management/#ssh-configuration >> >> Rotating other secrets is advised but the process is not yet >> established. Operators should assess their cluster's potential >> exposure to determine if immediate Monitor config-key secret rotation >> is required for their environment. >> >> >> ## CVE Fixes >> >> * CVE-2025-30156 is an authentication bypass in CephX caused by misuse >> of AES-CBC. >> >> See: https://docs.ceph.com/en/latest/security/CVE-2025-30156 >> >> * CVE-2026-39944 shares the unauthenticated-encryption root cause of >> CVE-2025-30156, but applies it to RGW's STS session tokens resulting >> in improper verification of a cryptographic signature. >> >> See: https://docs.ceph.com/en/latest/security/CVE-2026-39944 >> >> * CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor >> subscription handler. >> >> See: https://docs.ceph.com/en/latest/security/CVE-2026-50152 >> >> * CVE-2026-54330 is a flaw in RGW not properly verifying its SigV4 >> cryptographic signatures in RGW's SigV4 verifier. >> >> See: https://docs.ceph.com/en/latest/security/CVE-2026-54330 >> >> ## Other Media >> >> A Cephalocon 2025 talk covers some of the details surrounding the new >> CephX key upgrade process. >> >> https://cephalocon2025.sched.com/event/27f2O/rotating-heads-and-cephx-keys-… >> >> >> ## Getting Ceph >> ------------ >> * Source at https://github.com/ceph/ceph >> * v19.2.6 Tarball at >> https://download.ceph.com/tarballs/ceph-19.2.6.tar.gz >> * v20.2.4 Tarball at >> https://download.ceph.com/tarballs/ceph-20.2.4.tar.gz >> * Containers at https://quay.io/repository/ceph/ceph >> * For packages, see >> https://docs.ceph.com/en/latest/install/get-packages/ >> * For upgrade with cephadm, see: >> https://docs.ceph.com/en/latest/cephadm/upgrade/ >> * v19.2.6 Release git sha1: f9fd95b4335bad6a26d7a74468f55d269e8dbef4 >> * v20.2.4 Release git sha1: 7f793731f1b39eb4f465e960113d2363c311b964 >> > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io

1 0

Re: [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released
by Pedro Macedo 20 Aug '26

20 Aug '26

On 2026-08-20 12:57 PM, Maximilian Stinsky-Damke wrote: > Hi, > > I upgraded a test cluster to Ceph Squid 19.2.6 via cephadm. The following cephadm managed client keys were not rotated automatically: > > client.bootstrap-* (bootstrap-rgw, bootstrap-osd, ...) > client.ceph-exporter. > client.crash. > client.osd-lockbox.. > client.rgw. > > The Squid docs mention ceph orch daemon rotate-key <name>, but in 19.2.* this command does not exist. Also seeing this on the 20.2.4 image via cephadm - rotate-key is missing there, but present on 20.2.3. > https://docs.ceph.com/en/squid/cephadm/services/#deploying-a-daemon-on-a-ho… > https://github.com/ceph/ceph/blob/v19.2.6/src/pybind/mgr/cephadm/module.py#… > > What is the correct way to rotate these client keys via cephadm as part of the cve fix? > > Thanks for any guidance. > Best Regards > Max > > ________________________________ > From: Patrick Donnelly <ceph-users(a)ceph.io> > Sent: 19 August 2026 18:08 > To: ceph-users <ceph-users(a)ceph.io> > Subject: [ceph-users] [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released > > Warning: This email is from an unusual correspondent. > Warning: Make sure this is someone you trust. > > Today, August 19th, 2026, the Ceph project has released Tentacle > 20.2.4 and Squid 19.2.6 hotfixes for four CVEs across several > components. > > This is the sixth backport release in the Squid series. > > This is the fourth backport release in the Tentacle series. > > Additional details will be posted on the Ceph website/blog: > https://urlsand.esvalabs.com/?u=https%3A%2F%2Fceph.io%2Fen%2Fnews%2Fblog%2F… > > We strongly recommend that all Ceph operators upgrade to one of these > releases as soon as possible. > > > ## Critical Upgrade Steps > > The fix for CVE-2025-30156 introduces a new CephX key type, aes256k. > This is the first time Ceph has introduced a new key type for CephX > credentials. Therefore, a new procedure exists for upgrading and > rotating Ceph daemon keys as part of this CVE. Before upgrading a Ceph > cluster, the operator should familiarize themselves with the procedure > documented at: > > https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… > > These steps are for package-based deployments of Ceph. In other > sections, the document also includes new information about key > rotation procedures, monitor authentication controls, and emergency > recovery procedures. > > Deployments using cephadm will automate the process except for client > keys. You may notice that Cephadm spends more time than normal on the > upgrade after updating all daemon images. This is due to a new process > rotating the OSD and MDS keys. Please be patient. There are plans to > improve this in the future. > > Deployments using Rook will also automate rotation of some client keys > with some exclusions. Look to the Rook project’s announcement for more > details. > > Client and kernel upgrades are recommended to support aes256k. Note > that upstream Linux kernel client support began in kernel 7.0 and has > been backported to CentOS Stream 9 and 10. Check with your > distribution vendor for backported key support before rotating client > keys used by the kernel. > > As part of upgrading a Ceph cluster, six new health warnings and > errors will be generated. This is normal. As part of the process to > upgrade/rotate entity keys, you will address the warnings and errors > as you go. These are documented beginning here: > > https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… > > The CephX documentation has been brought up to date and vetted for > accuracy. Those changes are live here: > > https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… > > Regarding the fix for CVE-2026-54330, RGW will now reject Sigv4 > requests with `host` and `x-amz-` headers not included in the signed > subset. Unfortunately, the REST client used in multisite was > generating such improperly signed requests. > > If you are running multisite, you must set the ``rgw_sigv4_insecure`` > option to true before you begin to upgrade. After all clusters are > upgraded, set the option to ``false`` again. > > Regarding the fix for CVE-2026-50152, formal guidance on rotating all > secrets stored in the Monitor config-key store will be forthcoming. In > the meantime, operators of cephadm-managed clusters are strongly > encouraged to rotate the cephadm SSH key, as an established process > exists: > > See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… > > Rotating other secrets is advised but the process is not yet > established. Operators should assess their cluster's potential > exposure to determine if immediate Monitor config-key secret rotation > is required for their environment. > > > ## CVE Fixes > > * CVE-2025-30156 is an authentication bypass in CephX caused by misuse > of AES-CBC. > > See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… > > * CVE-2026-39944 shares the unauthenticated-encryption root cause of > CVE-2025-30156, but applies it to RGW's STS session tokens resulting > in improper verification of a cryptographic signature. > > See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… > > * CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor > subscription handler. > > See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… > > * CVE-2026-54330 is a flaw in RGW not properly verifying its SigV4 > cryptographic signatures in RGW's SigV4 verifier. > > See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… > > ## Other Media > > A Cephalocon 2025 talk covers some of the details surrounding the new > CephX key upgrade process. > > https://urlsand.esvalabs.com/?u=https%3A%2F%2Fcephalocon2025.sched.com%2Fev… > > ## Getting Ceph > ------------ > * Source at https://urlsand.esvalabs.com/?u=https%3A%2F%2Fgithub.com%2Fceph%2Fceph&e=50… > * v19.2.6 Tarball at https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdownload.ceph.com%2Ftarballs%… > * v20.2.4 Tarball at https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdownload.ceph.com%2Ftarballs%… > * Containers at https://urlsand.esvalabs.com/?u=https%3A%2F%2Fquay.io%2Frepository%2Fceph%2… > * For packages, see https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… > * For upgrade with cephadm, see: > https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… > * v19.2.6 Release git sha1: f9fd95b4335bad6a26d7a74468f55d269e8dbef4 > * v20.2.4 Release git sha1: 7f793731f1b39eb4f465e960113d2363c311b964 > > -- > Patrick Donnelly, Ph.D. > He / Him / His > Red Hat Partner Engineer > IBM, Inc. > GPG: 19F28A586F808C2402351B93C3301A3E258DD79D > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io > > -- > This message has been checked by Libraesva ESG and is found to be clean. > Follow this link to report as spam/bad: > https://mx10.wiit.cloud/action/4hQBLz2RJPzTh0J/report-as-bad > Follow this link to blocklist sender: > https://mx10.wiit.cloud/action/4hQBLz2RJPzTh0J/blocklist > > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io

1 0

Re: [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released
by Maximilian Stinsky-Damke 20 Aug '26

20 Aug '26

Hi, I upgraded a test cluster to Ceph Squid 19.2.6 via cephadm. The following cephadm managed client keys were not rotated automatically: client.bootstrap-* (bootstrap-rgw, bootstrap-osd, ...) client.ceph-exporter. client.crash. client.osd-lockbox.. client.rgw. The Squid docs mention ceph orch daemon rotate-key <name>, but in 19.2.* this command does not exist. https://docs.ceph.com/en/squid/cephadm/services/#deploying-a-daemon-on-a-ho… https://github.com/ceph/ceph/blob/v19.2.6/src/pybind/mgr/cephadm/module.py#… What is the correct way to rotate these client keys via cephadm as part of the cve fix? Thanks for any guidance. Best Regards Max ________________________________ From: Patrick Donnelly <ceph-users(a)ceph.io> Sent: 19 August 2026 18:08 To: ceph-users <ceph-users(a)ceph.io> Subject: [ceph-users] [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released Warning: This email is from an unusual correspondent. Warning: Make sure this is someone you trust. Today, August 19th, 2026, the Ceph project has released Tentacle 20.2.4 and Squid 19.2.6 hotfixes for four CVEs across several components. This is the sixth backport release in the Squid series. This is the fourth backport release in the Tentacle series. Additional details will be posted on the Ceph website/blog: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fceph.io%2Fen%2Fnews%2Fblog%2F… We strongly recommend that all Ceph operators upgrade to one of these releases as soon as possible. ## Critical Upgrade Steps The fix for CVE-2025-30156 introduces a new CephX key type, aes256k. This is the first time Ceph has introduced a new key type for CephX credentials. Therefore, a new procedure exists for upgrading and rotating Ceph daemon keys as part of this CVE. Before upgrading a Ceph cluster, the operator should familiarize themselves with the procedure documented at: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… These steps are for package-based deployments of Ceph. In other sections, the document also includes new information about key rotation procedures, monitor authentication controls, and emergency recovery procedures. Deployments using cephadm will automate the process except for client keys. You may notice that Cephadm spends more time than normal on the upgrade after updating all daemon images. This is due to a new process rotating the OSD and MDS keys. Please be patient. There are plans to improve this in the future. Deployments using Rook will also automate rotation of some client keys with some exclusions. Look to the Rook project’s announcement for more details. Client and kernel upgrades are recommended to support aes256k. Note that upstream Linux kernel client support began in kernel 7.0 and has been backported to CentOS Stream 9 and 10. Check with your distribution vendor for backported key support before rotating client keys used by the kernel. As part of upgrading a Ceph cluster, six new health warnings and errors will be generated. This is normal. As part of the process to upgrade/rotate entity keys, you will address the warnings and errors as you go. These are documented beginning here: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… The CephX documentation has been brought up to date and vetted for accuracy. Those changes are live here: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… Regarding the fix for CVE-2026-54330, RGW will now reject Sigv4 requests with `host` and `x-amz-` headers not included in the signed subset. Unfortunately, the REST client used in multisite was generating such improperly signed requests. If you are running multisite, you must set the ``rgw_sigv4_insecure`` option to true before you begin to upgrade. After all clusters are upgraded, set the option to ``false`` again. Regarding the fix for CVE-2026-50152, formal guidance on rotating all secrets stored in the Monitor config-key store will be forthcoming. In the meantime, operators of cephadm-managed clusters are strongly encouraged to rotate the cephadm SSH key, as an established process exists: See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… Rotating other secrets is advised but the process is not yet established. Operators should assess their cluster's potential exposure to determine if immediate Monitor config-key secret rotation is required for their environment. ## CVE Fixes * CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC. See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… * CVE-2026-39944 shares the unauthenticated-encryption root cause of CVE-2025-30156, but applies it to RGW's STS session tokens resulting in improper verification of a cryptographic signature. See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… * CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor subscription handler. See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… * CVE-2026-54330 is a flaw in RGW not properly verifying its SigV4 cryptographic signatures in RGW's SigV4 verifier. See: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… ## Other Media A Cephalocon 2025 talk covers some of the details surrounding the new CephX key upgrade process. https://urlsand.esvalabs.com/?u=https%3A%2F%2Fcephalocon2025.sched.com%2Fev… ## Getting Ceph ------------ * Source at https://urlsand.esvalabs.com/?u=https%3A%2F%2Fgithub.com%2Fceph%2Fceph&e=50… * v19.2.6 Tarball at https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdownload.ceph.com%2Ftarballs%… * v20.2.4 Tarball at https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdownload.ceph.com%2Ftarballs%… * Containers at https://urlsand.esvalabs.com/?u=https%3A%2F%2Fquay.io%2Frepository%2Fceph%2… * For packages, see https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… * For upgrade with cephadm, see: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fdocs.ceph.com%2Fen%2Flatest%2… * v19.2.6 Release git sha1: f9fd95b4335bad6a26d7a74468f55d269e8dbef4 * v20.2.4 Release git sha1: 7f793731f1b39eb4f465e960113d2363c311b964 -- Patrick Donnelly, Ph.D. He / Him / His Red Hat Partner Engineer IBM, Inc. GPG: 19F28A586F808C2402351B93C3301A3E258DD79D _______________________________________________ ceph-users mailing list -- ceph-users(a)ceph.io To unsubscribe send an email to ceph-users-leave(a)ceph.io -- This message has been checked by Libraesva ESG and is found to be clean. Follow this link to report as spam/bad: https://mx10.wiit.cloud/action/4hQBLz2RJPzTh0J/report-as-bad Follow this link to blocklist sender: https://mx10.wiit.cloud/action/4hQBLz2RJPzTh0J/blocklist

1 0

Re: [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released
by Wannes Smet 20 Aug '26

20 Aug '26

@Gregori: I have opened a ticket at our PVE support partner. I want to know too. ________________________________ From: Iztok Gregori <ceph-users(a)ceph.io> Sent: Thursday, August 20, 2026 10:33 To: ceph-users(a)ceph.io <ceph-users(a)ceph.io> Subject: [ceph-users] Re: [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released Hi! Silly question maybe, but I want to be sure, for RBD clients (Proxmox QEMU virtual machines in my case) the new key type needs updated "client libraries" to be "understood", right? Cheers Iztok On 19/08/26 18: 07, Patrick Donnelly wrote: ZjQcmQRYFpfptBannerStart This Message Is From an External Sender This message came from outside your organization. ZjQcmQRYFpfptBannerEnd Hi! Silly question maybe, but I want to be sure, for RBD clients (Proxmox QEMU virtual machines in my case) the new key type needs updated "client libraries" to be "understood", right? Cheers Iztok On 19/08/26 18:07, Patrick Donnelly wrote: > Today, August 19th, 2026, the Ceph project has released Tentacle > 20.2.4 and Squid 19.2.6 hotfixes for four CVEs across several > components. > > This is the sixth backport release in the Squid series. > > This is the fourth backport release in the Tentacle series. > > Additional details will be posted on the Ceph website/blog: > https://urldefense.com/v3/__https://ceph.io/en/news/blog/__;!!FtrhtPsWDhZ6t… > > We strongly recommend that all Ceph operators upgrade to one of these > releases as soon as possible. > > > ## Critical Upgrade Steps > > The fix for CVE-2025-30156 introduces a new CephX key type, aes256k. > This is the first time Ceph has introduced a new key type for CephX > credentials. Therefore, a new procedure exists for upgrading and > rotating Ceph daemon keys as part of this CVE. Before upgrading a Ceph > cluster, the operator should familiarize themselves with the procedure > documented at: > > https://urldefense.com/v3/__https://docs.ceph.com/en/latest/rados/configura… > > These steps are for package-based deployments of Ceph. In other > sections, the document also includes new information about key > rotation procedures, monitor authentication controls, and emergency > recovery procedures. > > Deployments using cephadm will automate the process except for client > keys. You may notice that Cephadm spends more time than normal on the > upgrade after updating all daemon images. This is due to a new process > rotating the OSD and MDS keys. Please be patient. There are plans to > improve this in the future. > > Deployments using Rook will also automate rotation of some client keys > with some exclusions. Look to the Rook project’s announcement for more > details. > > Client and kernel upgrades are recommended to support aes256k. Note > that upstream Linux kernel client support began in kernel 7.0 and has > been backported to CentOS Stream 9 and 10. Check with your > distribution vendor for backported key support before rotating client > keys used by the kernel. > > As part of upgrading a Ceph cluster, six new health warnings and > errors will be generated. This is normal. As part of the process to > upgrade/rotate entity keys, you will address the warnings and errors > as you go. These are documented beginning here: > > https://urldefense.com/v3/__https://docs.ceph.com/en/latest/rados/operation… > > The CephX documentation has been brought up to date and vetted for > accuracy. Those changes are live here: > > https://urldefense.com/v3/__https://docs.ceph.com/en/latest/architecture/in… > > Regarding the fix for CVE-2026-54330, RGW will now reject Sigv4 > requests with `host` and `x-amz-` headers not included in the signed > subset. Unfortunately, the REST client used in multisite was > generating such improperly signed requests. > > If you are running multisite, you must set the ``rgw_sigv4_insecure`` > option to true before you begin to upgrade. After all clusters are > upgraded, set the option to ``false`` again. > > Regarding the fix for CVE-2026-50152, formal guidance on rotating all > secrets stored in the Monitor config-key store will be forthcoming. In > the meantime, operators of cephadm-managed clusters are strongly > encouraged to rotate the cephadm SSH key, as an established process > exists: > > See: https://urldefense.com/v3/__https://docs.ceph.com/en/latest/cephadm/host-ma… > > Rotating other secrets is advised but the process is not yet > established. Operators should assess their cluster's potential > exposure to determine if immediate Monitor config-key secret rotation > is required for their environment. > > > ## CVE Fixes > > * CVE-2025-30156 is an authentication bypass in CephX caused by misuse > of AES-CBC. > > See: https://urldefense.com/v3/__https://docs.ceph.com/en/latest/security/CVE-20… > > * CVE-2026-39944 shares the unauthenticated-encryption root cause of > CVE-2025-30156, but applies it to RGW's STS session tokens resulting > in improper verification of a cryptographic signature. > > See: https://urldefense.com/v3/__https://docs.ceph.com/en/latest/security/CVE-20… > > * CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor > subscription handler. > > See: https://urldefense.com/v3/__https://docs.ceph.com/en/latest/security/CVE-20… > > * CVE-2026-54330 is a flaw in RGW not properly verifying its SigV4 > cryptographic signatures in RGW's SigV4 verifier. > > See: https://urldefense.com/v3/__https://docs.ceph.com/en/latest/security/CVE-20… > > ## Other Media > > A Cephalocon 2025 talk covers some of the details surrounding the new > CephX key upgrade process. > > https://urldefense.com/v3/__https://cephalocon2025.sched.com/event/27f2O/ro… > > ## Getting Ceph > ------------ > * Source at https://urldefense.com/v3/__https://github.com/ceph/ceph__;!!FtrhtPsWDhZ6tw… > * v19.2.6 Tarball at https://urldefense.com/v3/__https://download.ceph.com/tarballs/ceph-19.2.6.… > * v20.2.4 Tarball at https://urldefense.com/v3/__https://download.ceph.com/tarballs/ceph-20.2.4.… > * Containers at https://urldefense.com/v3/__https://quay.io/repository/ceph/ceph__;!!FtrhtP… > * For packages, see https://urldefense.com/v3/__https://docs.ceph.com/en/latest/install/get-pac… > * For upgrade with cephadm, see: > https://urldefense.com/v3/__https://docs.ceph.com/en/latest/cephadm/upgrade… > * v19.2.6 Release git sha1: f9fd95b4335bad6a26d7a74468f55d269e8dbef4 > * v20.2.4 Release git sha1: 7f793731f1b39eb4f465e960113d2363c311b964 > _______________________________________________ ceph-users mailing list -- ceph-users(a)ceph.io To unsubscribe send an email to ceph-users-leave(a)ceph.io

1 0

Re: [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released
by Iztok Gregori 20 Aug '26

20 Aug '26

Hi! Silly question maybe, but I want to be sure, for RBD clients (Proxmox QEMU virtual machines in my case) the new key type needs updated "client libraries" to be "understood", right? Cheers Iztok On 19/08/26 18:07, Patrick Donnelly wrote: > Today, August 19th, 2026, the Ceph project has released Tentacle > 20.2.4 and Squid 19.2.6 hotfixes for four CVEs across several > components. > > This is the sixth backport release in the Squid series. > > This is the fourth backport release in the Tentacle series. > > Additional details will be posted on the Ceph website/blog: > https://ceph.io/en/news/blog/ > > We strongly recommend that all Ceph operators upgrade to one of these > releases as soon as possible. > > > ## Critical Upgrade Steps > > The fix for CVE-2025-30156 introduces a new CephX key type, aes256k. > This is the first time Ceph has introduced a new key type for CephX > credentials. Therefore, a new procedure exists for upgrading and > rotating Ceph daemon keys as part of this CVE. Before upgrading a Ceph > cluster, the operator should familiarize themselves with the procedure > documented at: > > https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.h… > > These steps are for package-based deployments of Ceph. In other > sections, the document also includes new information about key > rotation procedures, monitor authentication controls, and emergency > recovery procedures. > > Deployments using cephadm will automate the process except for client > keys. You may notice that Cephadm spends more time than normal on the > upgrade after updating all daemon images. This is due to a new process > rotating the OSD and MDS keys. Please be patient. There are plans to > improve this in the future. > > Deployments using Rook will also automate rotation of some client keys > with some exclusions. Look to the Rook project’s announcement for more > details. > > Client and kernel upgrades are recommended to support aes256k. Note > that upstream Linux kernel client support began in kernel 7.0 and has > been backported to CentOS Stream 9 and 10. Check with your > distribution vendor for backported key support before rotating client > keys used by the kernel. > > As part of upgrading a Ceph cluster, six new health warnings and > errors will be generated. This is normal. As part of the process to > upgrade/rotate entity keys, you will address the warnings and errors > as you go. These are documented beginning here: > > https://docs.ceph.com/en/latest/rados/operations/health-checks/index.html#a… > > The CephX documentation has been brought up to date and vetted for > accuracy. Those changes are live here: > > https://docs.ceph.com/en/latest/architecture/index.html#high-availability-a… > > Regarding the fix for CVE-2026-54330, RGW will now reject Sigv4 > requests with `host` and `x-amz-` headers not included in the signed > subset. Unfortunately, the REST client used in multisite was > generating such improperly signed requests. > > If you are running multisite, you must set the ``rgw_sigv4_insecure`` > option to true before you begin to upgrade. After all clusters are > upgraded, set the option to ``false`` again. > > Regarding the fix for CVE-2026-50152, formal guidance on rotating all > secrets stored in the Monitor config-key store will be forthcoming. In > the meantime, operators of cephadm-managed clusters are strongly > encouraged to rotate the cephadm SSH key, as an established process > exists: > > See: https://docs.ceph.com/en/latest/cephadm/host-management/#ssh-configuration > > Rotating other secrets is advised but the process is not yet > established. Operators should assess their cluster's potential > exposure to determine if immediate Monitor config-key secret rotation > is required for their environment. > > > ## CVE Fixes > > * CVE-2025-30156 is an authentication bypass in CephX caused by misuse > of AES-CBC. > > See: https://docs.ceph.com/en/latest/security/CVE-2025-30156 > > * CVE-2026-39944 shares the unauthenticated-encryption root cause of > CVE-2025-30156, but applies it to RGW's STS session tokens resulting > in improper verification of a cryptographic signature. > > See: https://docs.ceph.com/en/latest/security/CVE-2026-39944 > > * CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor > subscription handler. > > See: https://docs.ceph.com/en/latest/security/CVE-2026-50152 > > * CVE-2026-54330 is a flaw in RGW not properly verifying its SigV4 > cryptographic signatures in RGW's SigV4 verifier. > > See: https://docs.ceph.com/en/latest/security/CVE-2026-54330 > > ## Other Media > > A Cephalocon 2025 talk covers some of the details surrounding the new > CephX key upgrade process. > > https://cephalocon2025.sched.com/event/27f2O/rotating-heads-and-cephx-keys-… > > ## Getting Ceph > ------------ > * Source at https://github.com/ceph/ceph > * v19.2.6 Tarball at https://download.ceph.com/tarballs/ceph-19.2.6.tar.gz > * v20.2.4 Tarball at https://download.ceph.com/tarballs/ceph-20.2.4.tar.gz > * Containers at https://quay.io/repository/ceph/ceph > * For packages, see https://docs.ceph.com/en/latest/install/get-packages/ > * For upgrade with cephadm, see: > https://docs.ceph.com/en/latest/cephadm/upgrade/ > * v19.2.6 Release git sha1: f9fd95b4335bad6a26d7a74468f55d269e8dbef4 > * v20.2.4 Release git sha1: 7f793731f1b39eb4f465e960113d2363c311b964 >

1 0

Re: [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released
by Dmitry Melekhov 20 Aug '26

20 Aug '26

19.08.2026 20:04, Patrick Donnelly пишет: > the operator should familiarize themselves with the procedure > documented at: > > https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.h… > > Hello! Is there step by step guide for cephadm installation? I do not want to miss something. Thank you!

1 0

Question on so-called tenant level roles in tentacle
by Christopher Durham 19 Aug '26

19 Aug '26

The release notes for ceph tentacle, at: https://docs.ceph.com/en/latest/releases/tentacle/ state the following "RGW: The User Account feature introduced in Squid provides first-class support for IAM APIs and policy. Our preliminary STS support was based on tenants, and exposed some IAM APIs to admins only. This tenant-level IAM functionality is now deprecated in favor of accounts. While we’ll continue to support the tenant feature itself for namespace isolation, the following features will be removed no sooner than the V release: Tenant-level IAM APIs including CreateRole, PutRolePolicy and PutUserPolicy, Use of tenant names instead of accounts in IAM policy documents, Interpretation of IAM policy without cross-account policy evaluation, S3 API support for cross-tenant names such as Bucket=’tenant:bucketname’ STS Lite and sts:GetSessionToken." Does the 'V' release mean the Vampire release? Does this statement mean that those API calls will be available in all tentacle releases and umbrella, but maybe not vampire? I need to have the CreateRole,PutRolePolicy et al available in tentacle and do a planned transition to IAM users/roles. Any documentation on how to do this? I have STS roles for various groups of users to gain temporary access to solme number of buckets and I want to be sure my upgrade to tentacle will be ok. (I am on 19.2.5 squid). We are not using tenants but buckets owned by various s3 users and roles to give temporary access to buckets by other users. We have been doing this since either nautilus or octopus and it has worked well for us. (We do not use the gui for role management but have our own python scripts to add users/buckets to roles). -Chris

1 0

Re: Affects of high pg count on OSD peering
by Elias Carter 19 Aug '26

19 Aug '26

> the IO should not be blocked for the entire pool but only for those repeering PGs Yes, the issue is that when running 600 PGs per OSD a high fraction of PGs re-peer simultaneously. > Gradually reweighting instead of setting an OSD "out" directly is a common practice among ceph users, there should be plenty of threads on this list about that. The downside is of course a lot more manual intervention and possibly (some) redundant data movement. Thank you for the confirmation. We run Ceph within kubernetes (rook) and my plan is to write an operator which will handle gradually reweighting OSDs as they are added/removed from the cluster. Rook allows setting the initial OSD weight, so my plan is to set the initial OSD weights to 0 and then have the operator gradually reweight the OSDs to 1. > One knob to turn could be to decrease osd_heartbeat_interval (number of seconds between peer pings) from 6 seconds to a lower value (1 second is the minimum, but I probably would start with 5 or 4 seconds). Thank you; I will try that out. We have a mix of 100G and 400G networks, so I think the increased ping frequency will be ok. I will try it out on our staging clusters first and report back if there are any interesting findings. Elias On Tue, Aug 18, 2026 at 2:21 AM Eugen Block <ceph-users(a)ceph.io> wrote: > Hi, > > the IO should not be blocked for the entire pool but only for those > repeering PGs. Warnings during that phase are expected. > Gradually reweighting instead of setting an OSD "out" directly is a > common practice among ceph users, there should be plenty of threads on > this list about that. The downside is of course a lot more manual > intervention and possibly (some) redundant data movement. > > One knob to turn could be to decrease osd_heartbeat_interval (number > of seconds between peer pings) from 6 seconds to a lower value (1 > second is the minimum, but I probably would start with 5 or 4 > seconds). That could (or probably would) increase network traffic > significantly, so it's a trade-off. If you have a test cluster with > similar behavior, test it there first. > > Regards, > Eugen > > Zitat von Elias Carter via ceph-users <ceph-users(a)ceph.io>: > > > We run Ceph clusters with high PG counts (300 PGs/OSD, 32k total PGs and > > upwards). > > > > Something that I have noticed is that CRUSH changes (marking an OSD as > out, > > or a new OSD joining the cluster) can cause many hundreds of PGs to remap > > and peer. During this time we get PG_AVAILABILITY health check warnings > as > > the OSDs need to peer with their new PGs before they can serve IOs. RADOS > > tail latency suffers because IOs sent to a peering PG are blocked until > > peering completes. > > > > I believe that the more PGs we have, the more PGs need to peer, and the > > longer IOs are blocked for the pool. > > > > Does anyone have suggestions on how to deal with PG peering blocking IOs? > > > > I was thinking about gradually re-weighting OSDs instead of marking them > > out or in, but that can result in multiple redundant data moves. > > > > Elias > > _______________________________________________ > > ceph-users mailing list -- ceph-users(a)ceph.io > > To unsubscribe send an email to ceph-users-leave(a)ceph.io > > > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io >

2 4

[CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released
by Patrick Donnelly 19 Aug '26

19 Aug '26

Today, August 19th, 2026, the Ceph project has released Tentacle 20.2.4 and Squid 19.2.6 hotfixes for four CVEs across several components. This is the sixth backport release in the Squid series. This is the fourth backport release in the Tentacle series. Additional details will be posted on the Ceph website/blog: https://ceph.io/en/news/blog/ We strongly recommend that all Ceph operators upgrade to one of these releases as soon as possible. ## Critical Upgrade Steps The fix for CVE-2025-30156 introduces a new CephX key type, aes256k. This is the first time Ceph has introduced a new key type for CephX credentials. Therefore, a new procedure exists for upgrading and rotating Ceph daemon keys as part of this CVE. Before upgrading a Ceph cluster, the operator should familiarize themselves with the procedure documented at: https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.h… These steps are for package-based deployments of Ceph. In other sections, the document also includes new information about key rotation procedures, monitor authentication controls, and emergency recovery procedures. Deployments using cephadm will automate the process except for client keys. You may notice that Cephadm spends more time than normal on the upgrade after updating all daemon images. This is due to a new process rotating the OSD and MDS keys. Please be patient. There are plans to improve this in the future. Deployments using Rook will also automate rotation of some client keys with some exclusions. Look to the Rook project’s announcement for more details. Client and kernel upgrades are recommended to support aes256k. Note that upstream Linux kernel client support began in kernel 7.0 and has been backported to CentOS Stream 9 and 10. Check with your distribution vendor for backported key support before rotating client keys used by the kernel. As part of upgrading a Ceph cluster, six new health warnings and errors will be generated. This is normal. As part of the process to upgrade/rotate entity keys, you will address the warnings and errors as you go. These are documented beginning here: https://docs.ceph.com/en/latest/rados/operations/health-checks/index.html#a… The CephX documentation has been brought up to date and vetted for accuracy. Those changes are live here: https://docs.ceph.com/en/latest/architecture/index.html#high-availability-a… Regarding the fix for CVE-2026-54330, RGW will now reject Sigv4 requests with `host` and `x-amz-` headers not included in the signed subset. Unfortunately, the REST client used in multisite was generating such improperly signed requests. If you are running multisite, you must set the ``rgw_sigv4_insecure`` option to true before you begin to upgrade. After all clusters are upgraded, set the option to ``false`` again. Regarding the fix for CVE-2026-50152, formal guidance on rotating all secrets stored in the Monitor config-key store will be forthcoming. In the meantime, operators of cephadm-managed clusters are strongly encouraged to rotate the cephadm SSH key, as an established process exists: See: https://docs.ceph.com/en/latest/cephadm/host-management/#ssh-configuration Rotating other secrets is advised but the process is not yet established. Operators should assess their cluster's potential exposure to determine if immediate Monitor config-key secret rotation is required for their environment. ## CVE Fixes * CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC. See: https://docs.ceph.com/en/latest/security/CVE-2025-30156 * CVE-2026-39944 shares the unauthenticated-encryption root cause of CVE-2025-30156, but applies it to RGW's STS session tokens resulting in improper verification of a cryptographic signature. See: https://docs.ceph.com/en/latest/security/CVE-2026-39944 * CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor subscription handler. See: https://docs.ceph.com/en/latest/security/CVE-2026-50152 * CVE-2026-54330 is a flaw in RGW not properly verifying its SigV4 cryptographic signatures in RGW's SigV4 verifier. See: https://docs.ceph.com/en/latest/security/CVE-2026-54330 ## Other Media A Cephalocon 2025 talk covers some of the details surrounding the new CephX key upgrade process. https://cephalocon2025.sched.com/event/27f2O/rotating-heads-and-cephx-keys-… ## Getting Ceph ------------ * Source at https://github.com/ceph/ceph * v19.2.6 Tarball at https://download.ceph.com/tarballs/ceph-19.2.6.tar.gz * v20.2.4 Tarball at https://download.ceph.com/tarballs/ceph-20.2.4.tar.gz * Containers at https://quay.io/repository/ceph/ceph * For packages, see https://docs.ceph.com/en/latest/install/get-packages/ * For upgrade with cephadm, see: https://docs.ceph.com/en/latest/cephadm/upgrade/ * v19.2.6 Release git sha1: f9fd95b4335bad6a26d7a74468f55d269e8dbef4 * v20.2.4 Release git sha1: 7f793731f1b39eb4f465e960113d2363c311b964 -- Patrick Donnelly, Ph.D. He / Him / His Red Hat Partner Engineer IBM, Inc. GPG: 19F28A586F808C2402351B93C3301A3E258DD79D

1 0