Ceph CephX CVE-2025-30156

The attacker must have network adjacency to the Ceph internal messenger network, which is the private storage network over which Ceph daemons and clients communicate - this network is typically isolated from the internet but reachable from any authorized storage client host, hypervisor, or compromised internal system. At least one valid CephX credential is required (PR:L); the credential may have minimal capabilities (e.g., a client key with restricted caps), as the attack modifies the credential scope fields in transit or in captured tokens rather than requiring a privileged starting point. CephX is the default and ubiquitous authentication mechanism in Ceph - no non-default configuration or optional feature needs to be enabled. Exploitation is bounded by the adjacent-network requirement: attackers without access to the Ceph storage network cannot exploit this remotely. No user interaction is required.

The vendor-confirmed CVSS score of 8.9 (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) accurately characterizes the threat profile: attack vector is adjacent-network only (the Ceph internal messenger network, not the internet), any valid CephX account is sufficient, no user interaction is needed, and the scope change reflects that a minimally privileged attacker can expand their credential reach across the cluster. EPSS data is absent from the provided intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. However, the underlying technique - CBC bit-flipping with a known or guessable plaintext structure - is well-documented in academic literature and requires no novel research, lowering the practical exploitation barrier for a capable attacker who already has Ceph network access. Even a mid-sized municipal IT team in zabrze operating a Ceph cluster for block storage or backup infrastructure should treat this as urgent, since the credential escalation path could expose LUKS passphrases and SSH keys if the cluster also runs cephadm. The adjacent-network attack vector meaningfully limits internet-scale exposure, but any internal host on the storage network - a compromised hypervisor, a misconfigured client, or a malicious insider - has the required adjacency. The combination of low attack complexity, no required user interaction, and high confidentiality and integrity impact makes this a genuine priority for Ceph operators, not a theoretical risk inflated by CVSS.

An attacker who has obtained a low-privilege CephX service key - for example, a client key with minimal caps granted to a backup agent - and who can reach the Ceph messenger network from a compromised host captures encrypted CephX authentication exchanges. Exploiting the hardcoded IV, they identify deterministic ciphertext patterns corresponding to known plaintext fields in the credential structure. Using CBC bit-flip arithmetic against a previously captured authentication token, they craft a modified ciphertext whose decryption expands the credential scope fields, then present the forged token to authenticate with elevated cluster permissions - accessing OSD data or monitor commands beyond their original grant.