CE
Vendor
ceph
16
CVEs
0
On KEV
0
New 30D
Products
CE9.1
ceph
ceph
11 CVEs0 on KEV0 new
CE8.8
Ceph-ansible
Ceph
2 CVEs0 on KEV0 new
CE–
Ceph-deploy
Ceph
2 CVEs0 on KEV0 new
CI7.5
Civetweb
Ceph
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-54330 | CE ceph ceph | 8.1 | Aug 27 | Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation |
| CVE-2026-50152 | CE ceph ceph | 9.1 | Aug 27 | Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users |
| CVE-2026-39944 | CE ceph ceph | 8.8 | Aug 27 | Ceph: CephX AES Authentication error |
| CVE-2025-30156 | CE ceph ceph | 8.9 | Aug 27 | Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery |
| CVE-2024-47866 | CE ceph ceph | 7.5 | Nov 12 | RGW DoS attack with empty HTTP header in S3 object copy |
| CVE-2020-1716 | CE Ceph-ansible Ceph | 8.8 | May 28 | A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services |
| CVE-2020-25677 | CE Ceph-ansible Ceph | 5.5 | Dec 8 | A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions |
| CVE-2020-1700 | CE Ceph Ceph | 6.5 | Feb 7 | A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects |
| CVE-2019-10222 | CE Ceph Ceph | 7.5 | Nov 8 | A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests |
| CVE-2019-3821 | CI Civetweb Ceph | 7.5 | Mar 27 | A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled |
| CVE-2017-7519 | CE Ceph Ceph | 4.4 | Jul 27 | In Ceph, a format string flaw was found in the way libradosstriper parses input from user |
| CVE-2018-1129 | CE Ceph Ceph | 6.5 | Jul 10 | A flaw was found in the way signature calculation was handled by cephx authentication protocol |
| CVE-2018-10861 | CE Ceph Ceph | 8.1 | Jul 10 | A flaw was found in the way ceph mon handles user requests |
| CVE-2017-12155 | CE Ceph Ceph | 6.3 | Dec 12 | A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable |
| CVE-2015-3010 | CE Ceph-deploy Ceph | – | Jun 16 | ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file |
| CVE-2015-4053 | CE Ceph-deploy Ceph | – | Jun 8 | The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by… |