Vulnerability · Published Jul 30, 2025 · Assigned by GitHub_M
CVE-2024-48916Ceph is vulnerable to authentication bypass through RadosGW
High 8.1
In plain English
A high-severity insufficient verification of data authenticity in ceph from ceph. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ceph | 16.2.15+ds-0+deb12u1 | DSA-5825-1 |
| Debian:12 | ceph | 16.2.15+ds-0+deb12u1 | DEBIAN-CVE-2024-48916 |
| Debian:13 | ceph | 18.2.4+ds-11 | DEBIAN-CVE-2024-48916 |
| Debian:14 | ceph | 18.2.4+ds-11 | DEBIAN-CVE-2024-48916 |
| Ubuntu:22.04:LTS | ceph | 17.2.7-0ubuntu0.22.04.2 | USN-7182-1 |
| Ubuntu:22.04:LTS | ceph | 17.2.7-0ubuntu0.22.04.2 | UBUNTU-CVE-2024-48916 |
| Ubuntu:24.04:LTS | ceph | 19.2.0-0ubuntu0.24.04.2 | UBUNTU-CVE-2024-48916 |
| Ubuntu:24.04:LTS | ceph | 19.2.0-0ubuntu0.24.04.2 | USN-7182-1 |
Affected products (as reported)
Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/ceph/ceph/security/advisories/GHSA-5g9m-mmp6-93mq x_refsource_CONFIRM