Ceph

9 CVEs across 4 Ceph products. Browse Ceph vulnerabilities, severities, and proof-of-concept exploits.

Ceph products with known CVEs

ProductCVEs
Ceph9
Ceph-Ansible2
Ceph-Deploy2
Civetweb1
Ceph CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2024-47866High7.52025-11-12Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object…
CVE-2024-48916High8.12025-07-30Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by…
CVE-2025-52555Medium6.52025-06-26Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can…
CVE-2020-1716High8.82021-05-28A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. A…
CVE-2020-25677Medium5.52020-12-08A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allows any user on the s…
CVE-2020-1700Medium6.52020-02-07A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disco…
CVE-2019-10222High7.52019-11-08A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW serve…
CVE-2019-3821High7.52019-03-27A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple con…
CVE-2017-7519Low2.32018-07-27In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstrip…
CVE-2018-1129Medium6.52018-07-10A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able t…
CVE-2018-10861High8.12018-07-10A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and co…
CVE-2017-12155Medium6.32017-12-12A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local…
CVE-2015-30102015-06-16ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading t…
CVE-2015-40532015-06-08The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sens…