MGASA-2026-0389
Advisory lineage Upstream: 4 Downstream: 0
Published: 09 Sept 2026, 23:52
Last modified:10 Sept 2026, 00:00
Vulnerability Summary
Overall Risk (default)
minimal
0/100 CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
09 Sept 2026, 23:52
Published
Vulnerability first disclosed
10 Sept 2026, 00:00
Last Modified
Vulnerability information updated
Description
Updated ceph packages fix security vulnerabilities Updated ceph packages fix various security issues allowing authentication bypasses to gain admin privileges on the OSD, MDS, and MGR services. Notice that some of the fixes require kernel support for aes256k (introduced in kernel 7). This update will not break installs using the old (and insecure) AES keys; warnings will appear to migrate all keys (check out "ceph health detail" or "ceph status").
Affected Systems
- mageia•ceph
< 20.2.4-1.mga10
References (12)
- https://advisories.mageia.org/MGASA-2026-0389.html
- https://bugs.mageia.org/show_bug.cgi?id=36147
- https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.html#upgrading-and-rotating-cephx-keys
- https://www.openwall.com/lists/oss-security/2026/08/19/4
- https://github.com/ceph/ceph/security/advisories/GHSA-rmjq-ffrm-j6vj
- https://docs.ceph.com/en/latest/security/CVE-2025-30156/
- https://web.mit.edu/tlyu/papers/krb4peril-ndss04.pdf
- https://github.com/ceph/ceph/security/advisories/GHSA-rg9p-5xcp-wm8h
- https://docs.ceph.com/en/latest/security/CVE-2026-50152/
- https://docs.ceph.com/en/latest/security/CVE-2026-54330
- https://github.com/ceph/ceph/security/advisories/GHSA-j73r-qrgx-jvq2
- https://docs.ceph.com/en/latest/security/CVE-2026-39944