# CVE-2025-30156: Ceph CephX authentication credential forgery via unauthenticated encryption

Source: https://junglewise.ai/threats/cve-2025-30156-ceph-cephx-authentication-credential-forgery-via-unauthenticated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-30156 · Severity: high · CVSS 8.9 · Published 2026-08-28

Ceph is a distributed storage platform used by organizations to store and manage large volumes of data across multiple servers. A weakness in Ceph's authentication protocol allows attackers with network visibility and low-level access to forge administrator credentials, bypass access controls, and potentially gain complete control over the storage cluster and all data within it.

Technologies: [Ceph](https://junglewise.ai/threats/technologies/ceph). Vendors: [Ceph](https://junglewise.ai/threats/vendors/ceph).

## Quick answers

**Is CVE-2025-30156 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-30156 being exploited in the wild.

**How severe is CVE-2025-30156?** High severity, with a CVSS score of 8.9, published 28 August 2026.

**Which products and versions are affected?** Ceph before 20.2.4 and 19.2.6.

**Is there a fix for CVE-2025-30156?** A patch was published on 2026: Fixed in Ceph 20.2.4 and 19.2.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-30156 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-30156?** Check whether you run Ceph at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The CephX authentication protocol in Ceph versions before 20.2.4 and 19.2.6 uses AES-128-CBC encryption with a hard-coded initialization vector (IV) and no message authentication code (MAC) to protect authentication tickets. This allows multiple attacks: (1) credential forgery via an encryption oracle attack—an attacker observing encrypted tickets can splice ciphertext blocks to create valid tickets for privileged entities like Manager, MDS, and OSD nodes; (2) privilege escalation by flipping a single bit in an encrypted ticket to set the allow_all flag, granting unrestricted cluster access. The attack requires network access to observe CephX traffic and possession of at least one low-privilege CephX key. Patches are available in Ceph 20.2.4 and 19.2.6, which add support for authenticated encryption using AES-256-HMAC-384 (RFC 8009).

## Affected products

- Ceph Ceph before 20.2.4 and 19.2.6

## Timeline

- 2026-08-28: disclosed: CVE-2025-30156 published
- 2026: patched: Fixed in Ceph 20.2.4 and 19.2.6

## References

- [https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f](https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f)
- [https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6](https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6)

## Related threats

- [Ceph Object Gateway SigV4 signature bypass via unsigned headers](https://junglewise.ai/threats/cve-2026-54330-ceph-object-gateway-sigv4-signature-bypass-via-unsigned-headers)
- [Ceph authorization bypass in config-key store](https://junglewise.ai/threats/cve-2026-50152-ceph-authorization-bypass-in-config-key-store)
- [Ceph RADOS Gateway STS token forgery via unauthenticated CBC mode](https://junglewise.ai/threats/cve-2026-39944-ceph-rados-gateway-sts-token-forgery-via-unauthenticated-cbc-mode)