Description
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ceph | ceph | <= 19.2.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ceph | 18.2.4+ds-11 | — |
| Debian 13 | ceph | 18.2.4+ds-11 | — |
| Debian 12 | ceph | 16.2.15+ds-0+deb12u1 | DSA-5825-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | ceph | 19.2.0-0ubuntu0.24.04.2 | USN-7182-1 |
| Ubuntu 22.04 LTS | ceph | 17.2.7-0ubuntu0.22.04.2 | USN-7182-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 8 | ceph +27 | 2:19.2.0-55.el9cp | RHSA-2026:79101, RHSA-2024:10956 |
| Red Hat Ceph Storage 7 | ceph +25 | 2:18.2.1-329.el8cp | RHSA-2025:4664 |
| Red Hat Ceph Storage 7 | cephadm | 2:18.2.1-329.el9cp | RHSA-2025:4664 |
| Red Hat Ceph Storage 7 | liboath +1 | 2.6.12-1.el8cp | RHSA-2025:4664 |
| Red Hat Ceph Storage 6 | liboath +1 | 2.6.12-1.el8cp | RHSA-2025:4238 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ceph | 18.2.2-10 | — |
| Azure Linux 2 (CBL-Mariner) | ceph | 16.2.10-9 | — |
Advisories 7
- RHSA-2026:79101 Red Hat Security Advisory: Red Hat Ceph Storage 8.1 security and bug fix updates Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:4664 Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security, bug fix, and enhancement updates Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:4238 Red Hat Security Advisory: Red Hat Ceph Storage 6.1 bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2024:10956 Red Hat Security Advisory: Red Hat Ceph Storage 8.0 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2024-3688 Red Hat Enterprise Linux (Ceph Storage): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 8, 2026
- USN-7182-1 ceph vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-5825-1 ceph - security update Debian Security (DSA / DLA) · Mar 9, 2026