Skip to content
OpenAdvisories
Critical RHSA-2026:79101 6 CVEs

Red Hat Security Advisory: Red Hat Ceph Storage 8.1 security and bug fix updates

Published Oct 10, 2026 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 59

ReleasePackageFixed in
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-base 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-base-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-common 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-common-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-debugsource 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-exporter-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-fuse 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-fuse-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-immutable-object-cache 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-immutable-object-cache-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-mds-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-mgr-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-mib 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-mon-client-nvmeof-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-mon-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-osd-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-radosgw-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-resource-agents 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-selinux 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 ceph-test-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 cephadm 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 cephfs-mirror-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 cephfs-top 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 libcephfs-daemon-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 libcephfs-devel 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 libcephfs-proxy2 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 libcephfs-proxy2-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 libcephfs2 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 libcephfs2-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 libcephsqlite-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 librados-devel 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 librados-devel-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 librados2 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 librados2-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 libradospp-devel 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 libradosstriper1 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 libradosstriper1-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 librbd-devel 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 librbd1 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 librbd1-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 librgw-devel 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 librgw2 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 librgw2-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 python3-ceph-argparse 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 python3-ceph-common 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 python3-cephfs 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 python3-cephfs-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 python3-rados 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 python3-rados-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 python3-rbd 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 python3-rbd-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 python3-rgw 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 python3-rgw-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 rbd-fuse-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 rbd-mirror-debuginfo 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 rbd-nbd 2:19.2.1-423.el9cp
Red Hat · Ceph Storage 8 ceph_storage:8.1::el9 rbd-nbd-debuginfo 2:19.2.1-423.el9cp

Vulnerabilities 6

  • Critical 9.1
    CVE-2026-50152

    Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users

    Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user …

    ceph ceph ceph ceph Debian Ubuntu
  • High 8.9
    CVE-2025-30156

    Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

    Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initia…

    ceph ceph ceph ceph Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-39944

    Ceph: CephX AES Authentication error

    Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway (RGW) protects STS session tokens with an AES-128-CBC handler that provides no message authentication, all…

    ceph ceph ceph ceph Debian Ubuntu
  • High 8.1
    CVE-2024-48916

    Ceph is vulnerable to authentication bypass through RadosGW

    Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC prov…

    ceph ceph ceph ceph Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2026-54330

    Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

    Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed heade…

    ceph ceph ceph ceph Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2023-48795 Public exploit Scanner template EPSS 94%

    Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

    zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2254210
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2329846
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393864
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519423
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519428
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2519431
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79101.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-48795
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-48795
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-48795
  • article
    https://access.redhat.com/solutions/7071748
  • article
    https://terrapin-attack.com/
  • report
    https://access.redhat.com/security/cve/CVE-2024-48916
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-48916
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-48916
  • article
    https://github.com/ceph/ceph/pull/60624/commits/919da3696668a07c6810dfa39301950c81c2eba4
  • article
    https://github.com/ceph/ceph/security/advisories/GHSA-5g9m-mmp6-93mq
  • article
    https://tracker.ceph.com/issues/68836
  • report
    https://access.redhat.com/security/cve/CVE-2025-30156
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-30156
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-30156
  • report
    https://access.redhat.com/security/cve/CVE-2026-39944
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-39944
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-39944
  • report
    https://access.redhat.com/security/cve/CVE-2026-50152
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-50152
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-50152
  • report
    https://access.redhat.com/security/cve/CVE-2026-54330
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-54330
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-54330