CVE-2025-30156

Received Received - Intake

CephX Authentication Bypass in Ceph Storage Platform

Publication date: 2026-08-28

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message authentication, allowing an attacker to forge credentials and gain cluster-wide access. Because the ciphertext is malleable and the monitor will encrypt attacker-chosen entity names, an attacker holding one low-privilege key and able to observe CephX traffic can use the monitor as an encryption oracle and splice ciphertext blocks into valid tickets for privileged entities such as Manager, MDS, and OSD. The same lack of authentication also lets an attacker with CephX permissions escalate privileges by flipping a single bit in a service ticket to set its allow_all field to true. This issue is fixed in versions 20.2.4 and 19.2.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2025-30156

Affected Vendors & Products

Vendor	Product	Version / Range
ceph	ceph	to 19.2.6 (exc)
red_hat	red_hat_enterprise_linux	*
ibm	ibm_storage_ceph	*
cllyso	cllyso_enterprise_storage	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-327	The product uses a broken or risky cryptographic algorithm or protocol.

Attack-Flow Graph

Executive Summary

CVE-2025-30156 is an authentication bypass in Ceph's CephX protocol due to misuse of AES-CBC encryption. The issue occurs because CephX uses unauthenticated AES-128-CBC encryption with a hard-coded initialization vector and no message authentication. This allows attackers to forge credentials and gain cluster-wide access by exploiting weaknesses in the encryption method.

Detection Guidance

Detecting this vulnerability requires checking the Ceph version in use. Run 'ceph --version' to verify if your system is running a vulnerable version (prior to 20.2.4 or 19.2.6). Additionally, monitor network traffic for CephX authentication exchanges to identify potential exploitation attempts.

Impact Analysis

An attacker with a low-privilege key and network access can observe CephX traffic to forge credentials for privileged roles like Manager, MDS, or OSD. They can also escalate privileges by flipping a bit in a service ticket to set the allow_all field to true. This grants full cluster access and control over the Ceph storage system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data stored in Ceph, potentially violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Unauthorized access may result in data breaches, non-compliance penalties, and loss of trust.

Mitigation Strategies

Upgrade Ceph to version 20.2.4 or 19.2.6 or later immediately. If upgrading is not possible, apply patches from downstream vendors like Red Hat, IBM, or CLYSO. Restrict network access to Ceph monitors and enforce strict authentication policies.

Hi! I’m here to help you understand CVE-2025-30156. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70