High severity · published Jul 30, 2025
CVE-2024-48916
Ceph is vulnerable to authentication bypass through RadosGW
8.1
CVSS
0.2%
EPSS
No
On KEV
Description
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
ceph · ceph
<= 19.2.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-48916
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-48916
github.com
https://github.com/ceph/ceph/security/advisories/GHSA-5g9m-mmp6-93mq
More from ceph
9.1
CVE-2026-50152
Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
8.9
CVE-2025-30156
Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery
8.8
CVE-2026-39944
Ceph: CephX AES Authentication error
8.1
CVE-2026-54330
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
8.1
CVE-2018-10861
A flaw was found in the way ceph mon handles user requests