Multiple Security Flaws in Ceph Affecting Fedora 43 and 44

Two significant security vulnerabilities have been identified in Ceph versions 19.2.6 and 20.2.4, affecting Fedora 43 and 44 respectively. CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC, while CVE-2026-39944 shares the same unauthenticated-encryption root cause. Additionally, CVE-2026-50152 presents an improper authorization flaw in the Ceph Monitor subscription handler, and CVE-2026-54330 involves RGW failing to verify SigV4 cryptographic signatures. These vulnerabilities could allow unauthorized access and manipulation of data stored in Ceph. Users are advised to update their systems immediately to mitigate these risks. The updates can be installed via the 'dnf' update program. Both advisories were published on August 22, 2026.

Key Points: • CVE-2025-30156 allows authentication bypass in CephX due to AES-CBC misuse. • CVE-2026-39944 shares a root cause with CVE-2025-30156, indicating systemic issues. • Immediate updates are recommended for Fedora 43 and 44 to address these vulnerabilities.