CVE-2025-30156: Ceph Storage Privilege Escalation Vulnerability

CVE-2025-30156 Overview

Ceph is an open-source distributed storage platform providing object, block, and file storage. CVE-2025-30156 is a cryptographic weakness [CWE-327] in the CephX authentication protocol that allows attackers to forge credentials and escalate privileges across the cluster. The protocol encrypts tickets using AES-128-CBC in an unauthenticated mode with a hard-coded initialization vector and no message authentication code. An attacker holding one low-privilege key can leverage the monitor as an encryption oracle to splice ciphertext blocks into valid tickets for privileged entities. The issue affects Ceph versions prior to 20.2.4 and 19.2.6.

Critical Impact
An adjacent-network attacker with a low-privilege CephX key can forge tickets for Manager, MDS, and OSD entities, or flip a single bit to grant themselves cluster-wide allow_all permissions.

Affected Products

Ceph distributed storage platform versions prior to 19.2.6
Ceph distributed storage platform versions prior to 20.2.4
CephX authentication protocol implementations in affected releases

Discovery Timeline

2026-08-28 - CVE-2025-30156 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2025-30156

Vulnerability Analysis

The CephX authentication protocol issues service tickets encrypted with AES-128-CBC. The implementation uses a hard-coded initialization vector and omits any message authentication, leaving ciphertext malleable. Because CBC ciphertext without integrity protection can be manipulated block-by-block, attackers can alter authentication material without detection.

The Ceph monitor compounds the flaw by encrypting attacker-chosen entity names during normal protocol operations. This behavior effectively turns the monitor into an encryption oracle. An attacker who can observe CephX traffic and holds any low-privilege key can request encryptions for chosen plaintexts, then splice the resulting ciphertext blocks into tickets for high-privilege entities such as Manager, MDS, or OSD.

A second attack path requires only CephX permissions. Because tickets are unauthenticated, flipping a single bit in a service ticket sets the allow_all field to true, granting full cluster access without needing the oracle path.

Root Cause

The root cause is the use of unauthenticated symmetric encryption for security-critical tokens. AES-128-CBC without a MAC provides confidentiality but not integrity. Combined with a static IV and monitor-controlled encryption of attacker-influenced plaintext, the design permits both chosen-ciphertext manipulation and bit-flipping attacks on ticket fields.

Attack Vector

The attack requires adjacent network access and a valid low-privilege CephX key. The attacker observes CephX traffic, uses the monitor to encrypt entity names of their choosing, and constructs a forged ticket by combining oracle-produced ciphertext blocks. Alternatively, the attacker modifies a legitimate ticket in transit to elevate the allow_all flag.

// Patched crypto handler registration in src/common/ceph_context.h
// Adds support for aes256-hmac384-192 to replace the unauthenticated AES-128-CBC path
   // crypto
   CryptoHandler *_crypto_none;
   CryptoHandler *_crypto_aes;
+  CryptoHandler *_crypto_aes256krb5;
   std::unique_ptr<CryptoRandom> _crypto_random;
 
   // experimental

Source: Ceph commit 3078188a

Detection Methods for CVE-2025-30156

Indicators of Compromise

Unexpected service tickets in CephX audit logs referencing Manager, MDS, or OSD entities that do not correspond to registered daemons.
Authentication events where a low-privilege client suddenly exercises cluster-wide operations consistent with the allow_all capability.
Anomalous volumes of monitor authentication requests from a single client key, indicating oracle abuse.

Detection Strategies

Inspect Ceph monitor logs for authentication requests that produce entity-name encryptions inconsistent with normal client bootstrapping.
Correlate CephX key usage against expected role behavior; flag low-privilege keys performing OSD, MDS, or Manager-scoped operations.
Baseline network traffic between clients and monitors on the adjacent network segment to detect eavesdropping positions.

Monitoring Recommendations

Enable verbose CephX authentication logging on all monitor daemons and forward logs to a centralized SIEM.
Alert on privilege changes and any ticket that grants allow_all outside a documented administrative workflow.
Monitor daemon registration events and compare them against ticket issuance activity for entity-name mismatches.

How to Mitigate CVE-2025-30156

Immediate Actions Required

Upgrade Ceph clusters to version 19.2.6 or 20.2.4, which introduce the aes256krb5 (aes256-hmac384-192) authenticated cipher handler.
Restrict management network access so only trusted hosts can reach monitor daemons over the adjacent network segment.
Rotate all CephX keys after patching to invalidate any credentials that may have been forged prior to upgrade.

Patch Information

The fix is available in Ceph 19.2.6 and 20.2.4. Upstream commits 2ba086255d and 3078188a7b introduce the _crypto_aes256krb5 handler that provides authenticated encryption for CephX tickets. See the Ceph GitHub Security Advisory GHSA-7q3q-3975-qw3q for the full advisory.

Workarounds

Isolate CephX traffic on a dedicated, encrypted management network to prevent attackers from observing tickets and reaching the monitor as an oracle.
Minimize the number of issued CephX keys and remove unused low-privilege keys that could serve as an attacker foothold.
Enforce network-layer authentication such as IPsec between Ceph clients and monitors where upgrading is not immediately feasible.

bash

# Verify the running Ceph version is patched
ceph --version

# Confirm upgraded daemons across the cluster
ceph versions

# Rotate a CephX key after upgrading (example: client.admin)
ceph auth get-or-create-key client.admin mon 'allow *' osd 'allow *' mds 'allow *' mgr 'allow *'