{"article":{"atomspec":["sys-cluster\/ceph"],"authoremail":"shiz2048@gmail.com","authorname":"Shiz01","body":["Ceph 20.2.4 (Tentacle) is a hotfix release addressing four CVEs [1]. The fix for CVE-2025-30156 introduces a new CephX key type, aes256k, and cluster operators must rotate and client keys by hand as part of the upgrade.","Read the upstream announcement [1] and the CephX key upgrade procedure [2] BEFORE you start.  If you deploy Ceph use cephadm or Rook you can skip key rotation instructions and only check client support.","The CVEs fixed in this release are:","  CVE-2025-30156  Authentication bypass in CephX caused by misuse                   of AES-CBC.   CVE-2026-39944  Improper verification of a cryptographic                   signature in the RGW STS session tokens.   CVE-2026-50152  Improper authorization in the Ceph Monitor                   subscription handler.   CVE-2026-54330  Improper SigV4 signature verification in RGW.","Manual steps required =====================","1. If you run RGW multisite, set \"rgw_sigv4_insecure\" to true on    every cluster BEFORE you begin.  The multisite REST client would    fall back into old insecure behaviour and would emit SigV4    requests that the fixed verifier rejects.    After ALL clusters upgrade, set this option back to false.","2. Upgrade the daemons in the usual Ceph order: mon's, then    mgr's, then OSDs, then MDSs, then the gateways and clients.","3. Expect six new health warnings and errors about insecure CephX    keys after the upgrade [3].  This is normal; they clear as you    work through the rotation.","4. Rotate the keys of all daemons and clients to aes256k, following    the instructions [2].","5. Kernel clients (kernel CephFS and krbd) only support aes256k    starting with Linux 7.0.  Check your kernel version before you    rotate any key that a kernel client uses, or that client will    lose access to the cluster.","6. Secrets kept in the mon config-key store may have been    exposed through CVE-2026-50152.  Upstream guidance on rotating    them is still pending; assess your own exposure and rotate what    you can in the meantime.","A cluster left with old keys stays vulnerable to the authentication bypass, so do not stop halfway through the rotation."],"newsid":"2026-09-12-ceph-manual-key-rotation","posted":"2026-09-12","title":"Ceph 20.2.4 requires manual CephX key rotation","urls":["https:\/\/ceph.io\/en\/news\/blog\/2026\/v20-2-4-v19-2-6-combo-released\/","https:\/\/docs.ceph.com\/en\/latest\/rados\/configuration\/auth-config-ref\/index.html#upgrading-and-rotating-cephx-keys","https:\/\/docs.ceph.com\/en\/latest\/rados\/operations\/health-checks\/index.html#auth-insecure-keys-creatable"]}}