What’s Vulnerable › Products

ceph vulnerabilities

23 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your ceph version is affected

Latest ceph vulnerabilities

• CVE-2026-54330 — Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation (CVSS 8.1)
• CVE-2026-50152 — Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users (CVSS 9.1)
• CVE-2026-39944 — Ceph: CephX AES Authentication error (CVSS 8.8)
• CVE-2025-30156 — Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery (CVSS 8.9)
• CVE-2024-47866 — RGW DoS attack with empty HTTP header in S3 object copy (CVSS 7.5)
• CVE-2024-48916 — Ceph is vulnerable to authentication bypass through RadosGW (CVSS 8.1)
• CVE-2025-52555 — CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS (CVSS 6.5)
• CVE-2022-3650 — (CVSS 7.8)
• CVE-2020-27839 — (CVSS 5.4)
• CVE-2021-3531 — (CVSS 5.3)
• CVE-2021-3524 — (CVSS 6.5)
• CVE-2020-25678 — (CVSS 4.4)
• CVE-2020-27781 — (CVSS 7.1)
• CVE-2020-25660 — (CVSS 8.8)
• CVE-2018-16889 — (CVSS 7.5)
• CVE-2018-14662 — (CVSS 5.7)
• CVE-2018-16846 — (CVSS 6.5)
• CVE-2016-8626 — (CVSS 6.5)
• CVE-2018-1128 — (CVSS 7.5)
• CVE-2018-7262 — (CVSS 7.5)
• CVE-2017-16818 — (CVSS 6.5)
• CVE-2016-5009 — (CVSS 6.5)
• CVE-2015-5245 — (CVSS 4.3)