Date: 2026-08-27
Updated: 2026-10-13
The Ceph project has released an important update for its Tentacle release series, in which two high-risk vulnerabilities are fixed [1].
EGI SVG ID : EGI-SVG-2026-41
CVE ID : CVE-2025-30156, CVE-2026-54330
CVSS Score :
Sites running Ceph are strongly advised to update their Ceph services as needed according to the Ceph release notes at [1].
Please take careful notice of the non-trivial update instructions!
Please consult the Ceph release notes at [1] and/or the Ceph community
support options [2] for advice on potential mitigation.
TLP:CLEAR information - Unimited distribution
https://advisories.egi.eu/Advisory-EGI-SVG-2026-41
https://advisories.egi.eu/Advisory-SVG-CVE-2025-30156
https://advisories.egi.eu/Advisory-SVG-CVE-2026-54330
Minor updates may be made without re-distribution to the sites.
This advisory is subject to the Creative Commons licence
https://creativecommons.org/licenses/by/4.0/ and
the EGI (https://www.egi.eu/) Software Vulnerability Group
must be credited. ---
Comments or questions should be sent to
svg-rat at mailman.egi.eu
Vulnerabilities relevant for EGI can be reported at
report-vulnerability at egi.eu
See [R 99] for further details, and other information on SVG.
[R 1] https://docs.ceph.com/en/latest/releases/tentacle/#v20-2-4-tentacle
[R 2] https://docs.ceph.com/en/reef/rados/troubleshooting/community/
[R 99] https://confluence.egi.eu/display/EGIBG/SVG+Advisories
SVG was alerted to this vulnerability by Barbara Krasovec (EGI CSIRT)