--- title: Ceph.io — [CVE] [URGENT] Squid v19.2.6 and Tentacle... description: The Ceph project shipped emergency hotfixes Squid v19.2.6 and Tentacle v20.2.4 to patch four CVEs, including a CephX authentication bypass caused by AES-CBC... canonical: https://daily.dev/posts/ceph-io-cve-urgent-squid-v19-2-6-and-tentacle-v20-2-4-released-bzynabdep twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ceph.io — [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released | daily.dev og:description: The Ceph project shipped emergency hotfixes Squid v19.2.6 and Tentacle v20.2.4 to patch four CVEs, including a CephX authentication bypass caused by AES-CBC... og:url: https://daily.dev/posts/ceph-io-cve-urgent-squid-v19-2-6-and-tentacle-v20-2-4-released-bzynabdep og:image: https://api.daily.dev/og/posts/BZynAbDeP.png og:image:alt: Ceph.io — [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ceph.io — [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released **[Ceph](https://daily.dev/sources/ceph)** · 3 min read · 5 upvotes · 0 comments ## Summary The Ceph project shipped emergency hotfixes Squid v19.2.6 and Tentacle v20.2.4 to patch four CVEs, including a CephX authentication bypass caused by AES-CBC misuse, an RGW STS token signature verification flaw, an improper authorization issue in the Monitor subscription handler, and an RGW SigV4 signature verification bug. The CephX fix introduces a new key type, aes256k, requiring operators to follow a new key upgrade and rotation procedure before updating clusters. Multisite RGW deployments must temporarily set rgw_sigv4_insecure to true during the upgrade. Cephadm and Rook automate most key rotation, but client keys need manual handling, and kernel client support for aes256k requires Linux kernel 7.0 or later, backported to CentOS Stream 9/10. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What CVEs are fixed in Ceph Squid 19.2.6 and Tentacle 20.2.4? Four CVEs are fixed: CVE-2025-30156, a CephX authentication bypass caused by misuse of AES-CBC; CVE-2026-39944, an improper signature verification affecting RGW STS session tokens with the same unauthenticated-encryption root cause; CVE-2026-50152, an improper authorization flaw in the Ceph Monitor subscription handler; and CVE-2026-54330, a flaw in RGW's SigV4 signature verifier. _Ceph operators tracking storage CVEs and patch cycles can follow updates like these on daily.dev._ ### What special steps are needed to upgrade Ceph clusters to fix CVE-2025-30156? The fix introduces a new CephX key type called aes256k, the first new key type ever added for CephX credentials, requiring a new procedure for upgrading and rotating Ceph daemon keys. Cephadm-managed deployments automate most of this except client keys, and the upgrade will take longer than normal due to OSD and MDS key rotation; six new health warnings will appear during the process as expected. _Teams planning a Ceph upgrade can track procedural changes like this key rotation on daily.dev._ ### Do I need to change any settings before upgrading a Ceph multisite deployment for CVE-2026-54330? Yes, operators running multisite must set the rgw_sigv4_insecure option to true before starting the upgrade, because the fix makes RGW reject Sigv4 requests with host and x-amz- headers not in the signed subset, and the REST client used in multisite generated improperly signed requests. After all clusters are upgraded, the option should be set back to false. _Operators coordinating multisite storage upgrades can stay ahead of breaking config changes via daily.dev._ ## Similar posts on daily.dev - [Daily OT Security News: September 23, 2026](https://daily.dev/posts/daily-ot-security-news-september-23-2026-vwdy21qxx) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/ceph-io-cve-urgent-squid-v19-2-6-and-tentacle-v20-2-4-released-bzynabdep) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ceph.io — [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released","url":"https://daily.dev/posts/ceph-io-cve-urgent-squid-v19-2-6-and-tentacle-v20-2-4-released-bzynabdep","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ceph-io-cve-urgent-squid-v19-2-6-and-tentacle-v20-2-4-released-bzynabdep"},"datePublished":"2026-08-23T12:17:38.206Z","dateModified":"2026-09-14T08:58:04.976Z","description":"The Ceph project shipped emergency hotfixes Squid v19.2.6 and Tentacle v20.2.4 to patch four CVEs, including a CephX authentication bypass caused by AES-CBC...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f74055db56e6d16258a5804db5001afd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f74055db56e6d16258a5804db5001afd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Ceph","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Ceph","logo":"https://media.daily.dev/image/upload/s--nHzZM4Ap--/f_auto,q_auto/v1787487446/logos/ceph?_a=BAMAMicg0","url":"https://daily.dev/sources/ceph"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ceph-io-cve-urgent-squid-v19-2-6-and-tentacle-v20-2-4-released-bzynabdep","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,cryptography","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ceph","item":"https://daily.dev/sources/ceph"},{"@type":"ListItem","position":3,"name":"Ceph.io — [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ceph-io-cve-urgent-squid-v19-2-6-and-tentacle-v20-2-4-released-bzynabdep#faq","mainEntity":[{"@type":"Question","name":"What CVEs are fixed in Ceph Squid 19.2.6 and Tentacle 20.2.4?","acceptedAnswer":{"@type":"Answer","text":"Four CVEs are fixed: CVE-2025-30156, a CephX authentication bypass caused by misuse of AES-CBC; CVE-2026-39944, an improper signature verification affecting RGW STS session tokens with the same unauthenticated-encryption root cause; CVE-2026-50152, an improper authorization flaw in the Ceph Monitor subscription handler; and CVE-2026-54330, a flaw in RGW's SigV4 signature verifier. Ceph operators tracking storage CVEs and patch cycles can follow updates like these on daily.dev."}},{"@type":"Question","name":"What special steps are needed to upgrade Ceph clusters to fix CVE-2025-30156?","acceptedAnswer":{"@type":"Answer","text":"The fix introduces a new CephX key type called aes256k, the first new key type ever added for CephX credentials, requiring a new procedure for upgrading and rotating Ceph daemon keys. Cephadm-managed deployments automate most of this except client keys, and the upgrade will take longer than normal due to OSD and MDS key rotation; six new health warnings will appear during the process as expected. Teams planning a Ceph upgrade can track procedural changes like this key rotation on daily.dev."}},{"@type":"Question","name":"Do I need to change any settings before upgrading a Ceph multisite deployment for CVE-2026-54330?","acceptedAnswer":{"@type":"Answer","text":"Yes, operators running multisite must set the rgw_sigv4_insecure option to true before starting the upgrade, because the fix makes RGW reject Sigv4 requests with host and x-amz- headers not in the signed subset, and the REST client used in multisite generated improperly signed requests. After all clusters are upgraded, the option should be set back to false. Operators coordinating multisite storage upgrades can stay ahead of breaking config changes via daily.dev."}}]} ```