Gentoo Packages

Ceph 20.2.4 (Tentacle) is a hotfix release addressing four CVEs [1]. The fix for CVE-2025-30156 introduces a new CephX key type, aes256k, and cluster operators must rotate and client keys by hand as part of the upgrade.

Read the upstream announcement [1] and the CephX key upgrade procedure [2] BEFORE you start. If you deploy Ceph use cephadm or Rook you can skip key rotation instructions and only check client support.

The CVEs fixed in this release are:

CVE-2025-30156  Authentication bypass in CephX caused by misuse
                of AES-CBC.
CVE-2026-39944  Improper verification of a cryptographic
                signature in the RGW STS session tokens.
CVE-2026-50152  Improper authorization in the Ceph Monitor
                subscription handler.
CVE-2026-54330  Improper SigV4 signature verification in RGW.

Manual steps required =====================

1. If you run RGW multisite, set "rgw_sigv4_insecure" to true on

 every cluster BEFORE you begin.  The multisite REST client would
 fall back into old insecure behaviour and would emit SigV4
 requests that the fixed verifier rejects.
 After ALL clusters upgrade, set this option back to false.

2. Upgrade the daemons in the usual Ceph order: mon's, then

 mgr's, then OSDs, then MDSs, then the gateways and clients.

3. Expect six new health warnings and errors about insecure CephX

 keys after the upgrade [3].  This is normal; they clear as you
 work through the rotation.

4. Rotate the keys of all daemons and clients to aes256k, following

 the instructions [2].

5. Kernel clients (kernel CephFS and krbd) only support aes256k

 starting with Linux 7.0.  Check your kernel version before you
 rotate any key that a kernel client uses, or that client will
 lose access to the cluster.

6. Secrets kept in the mon config-key store may have been

 exposed through CVE-2026-50152.  Upstream guidance on rotating
 them is still pending; assess your own exposure and rotate what
 you can in the meantime.

A cluster left with old keys stays vulnerable to the authentication bypass, so do not stop halfway through the rotation.

[1] https://ceph.io/en/news/blog/2026/v20-2-4-v19-2-6-combo-released/ [2] https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.html#upgrading-and-rotating-cephx-keys [3] https://docs.ceph.com/en/latest/rados/operations/health-checks/index.html#auth-insecure-keys-creatable