Ceph auth flaws force keyring rotation across OpenStack

OpenStack clouds that store data on Ceph must upgrade servers and rotate every CephX keyring after four authentication vulnerabilities were patched in Ceph 20.2.4 and 19.2.6, according to OpenStack Security Note OSSN-0108 written by Goutham Pacha Ravi.

The bugs affect CephX, the shared-secret scheme OpenStack services use to authenticate to Ceph. Nova, Cinder, Glance, and Manila are in scope whenever they hold CephX keyrings, as is the RADOS Gateway when it backs Swift or S3. An attacker who obtains any CephX entity secret, including from network traffic, can alter a ticket’s permissions without detection and forge credentials for higher-privileged services. The root causes are a hardcoded initialization vector that makes identical plaintexts produce identical ciphertexts, and a missing message authentication code that allows CBC bit-flipping.

The note assigns CVE-2025-30156, CVE-2026-39944, CVE-2026-50152, and CVE-2026-54330. Data-at-rest encryption is untouched by CVE-2025-30156 but is affected by CVE-2026-50152; the updates close all four.

In ordinary RBD, RGW, or NFS layouts the exposure is largely internal: guests never see the CephX secret or the storage network, so only someone already on a hypervisor or similar host can abuse the flaws. Tenants given native CephFS through Manila are different; they hold usable credentials and could exploit the bugs directly.

The fix switches CephX to AES-256-CTS-HMAC-SHA384-192 (RFC 8009) under a new key type. Both Ceph servers and every OpenStack client package must be upgraded first. Only then should operators rotate the keyrings used by OpenStack services, after which virtual machines need a restart or live migration to load the new material. Rotating before the clients are current leaves services unable to authenticate.