CVE-2025-30156: Fedora 44 Ceph 20.2.4 Authentication Bypass — Detection, Hardening, and Remediation Guide

Fedora 44 has shipped Ceph 20.2.4 to correct multiple security issues in the Ceph distributed storage stack, including an authentication bypass tracked as CVE-2025-30156 and related authorization flaws. The advisory is short on exploit detail, but the defensive implication is not: Ceph often sits behind business-critical workloads — OpenStack, Kubernetes RWO/RWX storage, backup repositories, image registries, and object stores — and it frequently spans networks that administrators assume are trusted. An authentication or authorization weakness in this layer is not a single-host problem. It is a data-plane integrity and confidentiality problem across pools, OSDs, CephFS namespaces, and RADOS Gateway buckets.

If you run Ceph from Fedora packages, treat this as a patch-now advisory. The fixed build is Ceph 20.2.4 for Fedora 44. The source summary does not publish a CVSS vector, in-the-wild exploit evidence, or CISA KEV status, so do not invent certainty where none exists. Do assume exploitability is plausible where an attacker can reach Ceph services, especially radosgw, dashboard endpoints, MON/MGR interfaces, or cluster networks that were never intended to be routed to user or internet segments.

What is affected

The affected platform called out in the news item is Fedora 44 with Ceph packages prior to the 20.2.4 update. In practical environments, that can include:

• Ceph Monitor, Manager, OSD, MDS, and RADOS Gateway nodes installed from Fedora packages
• Ceph clusters providing RBD images to virtualization or cloud platforms
• CephFS metadata servers and kernel/FUSE clients
• RADOS Gateway / S3-compatible object stores exposed to applications
• Ceph Dashboard and prometheus/manager endpoints reachable from admin networks

Ceph deployments vary widely, but the usual exposure points are the client/public network and any cluster service accidentally reachable beyond the storage VLAN. Common service families include MON traffic, OSD/MGR/MDS cluster traffic, radosgw HTTP/S, dashboard HTTP/S, and manager metrics. Port assignments are deployment-specific; do not rely on defaults as your source of truth. Enumerate what is actually listening.

Technical analysis: why this class of bug matters

Ceph security is built around a small number of assumptions: clients and daemons authenticate with cephx, cluster and public networks are isolated, service accounts carry least-privilege caps, and management endpoints are TLS-protected and tightly restricted. Authentication bypass breaks the first assumption. Authorization flaws break the third. Combined, they can turn a legitimate-looking request into unauthorized reads, writes, snapshot manipulation, bucket/object access, metadata changes, or privilege escalation inside the storage fabric.

From a defender's perspective, the likely attack chain is less about memory corruption drama and more about reachability plus trust failure:

1. Attacker obtains network access to a Ceph endpoint — through an exposed radosgw, flat network, compromised admin host, container workload with overbroad egress, or misrouted service.
2. Authentication or authorization checks fail to correctly constrain the request.
3. The attacker accesses data or capabilities beyond their identity, such as objects, buckets, pools, RBD images, CephFS paths, or manager/dashboard functions.
4. Impact expands from one service to stored data integrity, confidentiality, and availability — including destructive actions that resemble ransomware without needing endpoint encryption at all.

The most dangerous phrase in Ceph incident reviews is: 'That network was internal, so cephx and firewalling were relaxed.' Internal is not a control. Flat storage networks are exactly where authentication and authorization defects become materially worse.

Exploitation status

The provided advisory does not state that CVE-2025-30156 has a public exploit, confirmed active exploitation, or CISA KEV inclusion at release time. That absence is not reassurance. Authentication bypasses in infrastructure services are attractive precisely because they can produce high-value access with low forensic noise when logging is weak. Prioritize remediation based on exposure and blast radius, not on waiting for a PoC.

Detection and response

Ceph exploitation may not create a canonical malware artifact on endpoints. Your highest-fidelity signals are: unexpected network reachability to storage services, authentication/authorization anomalies in Ceph logs, configuration drift around cephx/TLS/keyrings, and unexpected service restarts or daemon crashes after probing. Build detections that answer one question: who is talking to Ceph, and should they be?

---
title: Ceph Configuration or Keyring Modification Outside Change Window
id: 8b2a7c41-6c1a-4c6a-9d8d-0b3f2a5e6c71
status: experimental
description: Detects writes to Ceph configuration or cephx keyring files, which may indicate attempt to weaken authentication, rotate unauthorized keys, or persist access after exploiting CVE-2025-30156 or related authorization flaws.
references:
  - https://linuxsecurity.com/advisories/fedora/ceph-fedora-2026-7de7d03796
author: Security Arsenal
date: 2026/05/22
tags:
  - attack.defense_evasion
  - attack.t1078
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|startswith:
      - '/etc/ceph/'
  selection_names:
    TargetFilename|contains:
      - 'ceph.conf'
      - '.keyring'
      - 'ceph.client.'
      - 'ceph.mon.'
  condition: selection_paths and selection_names
falsepositives:
  - Orchestrated cephadm or ansible changes during approved maintenance
  - Legitimate key rotation by storage administrators
level: high
---
title: Suspicious Network Exposure to Ceph Service Ports
id: 3f7d5b90-0aa6-4d28-b22b-9c6d1e7a4b55
status: experimental
description: Detects connections to common Ceph service ports from processes or hosts that should not normally initiate storage control/data-plane access. Tune DestinationPort to the actual cluster map before deployment.
references:
  - https://linuxsecurity.com/advisories/fedora/ceph-fedora-2026-7de7d03796
author: Security Arsenal
date: 2026/05/22
tags:
  - attack.discovery
  - attack.t1046
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection_ports:
    DestinationPort:
      - 3300
      - 6789
      - 6800
      - 7300
      - 7480
      - 8080
      - 8443
      - 9283
  filter_expected_initiators:
    Image|endswith:
      - '/ceph-mon'
      - '/ceph-mgr'
      - '/ceph-osd'
      - '/ceph-mds'
      - '/radosgw'
      - '/ceph'
  condition: selection_ports and not filter_expected_initiators
falsepositives:
  - Monitoring, backup, OpenStack, Kubernetes CSI, and object clients legitimately using Ceph
  - Load balancers and ingress controllers fronting RADOS Gateway
level: medium
---
title: Shell or Network Tool Spawned by Ceph Daemon Context
id: c51f9aa2-8b7e-4c2a-9b90-5e0d3a67c214
status: experimental
description: Detects ceph daemon processes spawning shells, curl, wget, or interpreters. Rare during normal operations and useful as post-exploitation or persistence telemetry after service compromise.
references:
  - https://linuxsecurity.com/advisories/fedora/ceph-fedora-2026-7de7d03796
author: Security Arsenal
date: 2026/05/22
tags:
  - attack.execution
  - attack.t1059
  - attack.persistence
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/ceph-mon'
      - '/ceph-mgr'
      - '/ceph-osd'
      - '/ceph-mds'
      - '/radosgw'
      - '/ceph-crash'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor support scripts or emergency debugging by storage administrators
level: high

// Hunt Ceph auth/authz anomalies and unexpected storage reachability in Sentinel.
// Assumes Linux syslog/CEF ingestion from Ceph nodes and network telemetry via CommonSecurityLog or Defender network data.
let cephPorts = dynamic([3300,6789,6800,7300,7480,8080,8443,9283]);
union isfuzzy=true
  (Syslog
    | where Computer has_any ('ceph','storage','osd','mon','mgr','rgw') or ProcessName has_any ('ceph','radosgw','rbd','ceph-fuse')
    | where SyslogMessage has_any ('auth','denied','unauthor','invalid key','bad caps','permission','AccessDenied','SignatureDoesNotMatch','403','401')
    | project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel),
  (CommonSecurityLog
    | where DestinationPort in (cephPorts)
    | where DeviceAction !in ('Allow','allow') or Message has_any ('deny','denied','drop','reject')
    | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Message),
  (DeviceNetworkEvents
    | where RemotePort in (cephPorts)
    | where InitiatingProcessFileName !in~ ('ceph-mon','ceph-mgr','ceph-osd','ceph-mds','radosgw','ceph','python3')
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort)
| summarize count() by TimeGenerated, Computer, DeviceName, ProcessName, InitiatingProcessFileName, SourceIP, RemoteIP, DestinationIP, DestinationPort, RemotePort, SyslogMessage, Message
| order by TimeGenerated desc

-- Inventory Ceph daemons, listeners, and recent config/keyring drift on Linux storage nodes.
LET ceph_procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(ceph|radosgw|rbd|ceph-fuse)'
   OR CommandLine =~ '(ceph|radosgw|rbd|ceph-fuse)'

LET ceph_ports = SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE LocalPort in (3300,6789,6800,7300,7480,8080,8443,9283)
   OR Name =~ '(ceph|radosgw)'

LET ceph_files = SELECT FullPath, Mtime, Size
FROM glob(globs='/etc/ceph/**')
WHERE FullPath =~ '(ceph.conf|keyring|ceph.client|ceph.mon)'

SELECT 'process' AS ArtifactType, Pid, Name, CommandLine, Exe, Username, CreateTime, NULL AS LocalAddress, NULL AS LocalPort, NULL AS FullPath, NULL AS Mtime FROM ceph_procs
UNION ALL
SELECT 'listener' AS ArtifactType, Pid, Name, NULL AS CommandLine, NULL AS Exe, NULL AS Username, NULL AS CreateTime, LocalAddress, LocalPort, NULL AS FullPath, NULL AS Mtime FROM ceph_ports
UNION ALL
SELECT 'config_file' AS ArtifactType, NULL AS Pid, NULL AS Name, NULL AS CommandLine, NULL AS Exe, NULL AS Username, NULL AS CreateTime, NULL AS LocalAddress, NULL AS LocalPort, FullPath, Mtime FROM ceph_files

#!/usr/bin/env bash
# Fedora 44 Ceph remediation and verification helper for CVE-2025-30156 / Ceph 20.2.4
set -euo pipefail

# 1) Patch Ceph packages from Fedora updates.
sudo dnf clean expire-cache
sudo dnf -y upgrade 'ceph*' 'librados*' 'librbd*' 'libcephfs*' 'python3-rados' 'python3-rbd' 'python3-cephfs'

# 2) Verify installed version and daemon versions after restart.
rpm -q ceph ceph-base ceph-mgr ceph-mon ceph-osd radosgw 2>/dev/null || rpm -q ceph
ceph --version || true
sudo ceph versions || true

# 3) Restart Ceph daemons only after confirming cluster health and maintenance plan.
sudo ceph -s
read -r -p 'Cluster HEALTH_OK/HEALTH_WARN and change window approved? type RESTART to continue: ' confirm
if [ "$confirm" = "RESTART" ]; then
  sudo systemctl restart ceph.target || true
  sudo cephadm ls || true
fi

# 4) Confirm cephx is not disabled. Expected secure posture: auth_*_required = cephx.
ceph config get mon auth_cluster_required || true
ceph config get mon auth_service_required || true
ceph config get mon auth_client_required || true

# 5) Audit listeners and restrict exposure to approved clients only.
ss -lntup | egrep ':(3300|6789|6800|7300|7480|8080|8443|9283)\b' || true
sudo firewall-cmd --list-all || true

# 6) Preserve logs for review before rotation and look for auth/authorization anomalies.
sudo journalctl -u 'ceph*' --since '24 hours ago' --no-pager | egrep -i 'auth|denied|unauthor|invalid|signature|AccessDenied|forbidden|401|403' | tail -n 200

Remediation guidance

1. Patch Fedora 44 Ceph packages to 20.2.4 immediately. Use the Fedora advisory as the canonical update reference: https://linuxsecurity.com/advisories/fedora/ceph-fedora-2026-7de7d03796. Confirm package version with rpm -q ceph and daemon version with ceph versions after restart.
2. Restart safely. Storage is not web-tier cattle. Confirm ceph -s, review ceph health detail, check OSD nearfull ratios, verify recovery/backfill state, snapshot critical metadata where appropriate, and restart daemons under change control or via cephadm orchestration.
3. Verify cephx everywhere. Ensure auth_cluster_required, auth_service_required, and auth_client_required are set to cephx. Investigate any none value as a critical finding unless there is an explicit, compensating, documented architecture.
4. Re-check caps and users. Audit ceph auth ls for broad caps such as allow *, unmanaged client.admin distribution, stale automation users, and radosgw accounts or S3 keys no longer tied to owners. Reduce RBD, CephFS, MDS, OSD, and MON caps to least privilege.
5. Lock down reachability. Ceph public/cluster networks should not be reachable from user VLANs, serverless egress, CI runners, internet-facing load balancers, or general application subnets unless explicitly required. Put radosgw behind TLS and a tightly scoped ingress/WAF path. Restrict dashboard and manager endpoints to admin jump hosts and MFA-backed access.
6. Validate TLS and service exposure. Confirm radosgw/dashboard TLS certificates, disable plaintext admin endpoints where possible, and remove legacy listeners. Treat 8080, dashboard, Prometheus, and undocumented high ports as assets that must be either justified or blocked.
7. Increase logging before you need it. Forward Ceph daemon logs, radosgw ops logs, auditd file writes under /etc/ceph, and firewall denies for storage ports to your SIEM. If you cannot answer who accessed a bucket or RBD image, you do not have enough telemetry.
8. Hunt for pre-patch access. Review 7-30 days of radosgw S3 errors, cephx failures, new keyring files, unexpected ceph auth changes, snapshot deletions, pool/RBD changes, and network connections to storage ports from new source IPs. An authentication bypass often looks 'valid enough' unless you baseline identities.
9. If compromise is suspected: isolate the node from public/client networks without powering it off, preserve /var/log/ceph, journald, keyrings, ceph.conf, radosgw logs, and ceph auth ls output, rotate cephx keys and S3 credentials under IR control, and validate data integrity from known-good snapshots or backups.

The broader lesson is current and uncomfortable: distributed storage platforms are now identity systems. When authentication and authorization fail there, perimeter thinking will not save you. Patch Fedora 44 Ceph to 20.2.4, prove cephx is enforced, prove the network is segmented, and prove your logs can reconstruct access.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub