Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is that a user could read, write and execute to any directory owned by root as long as they chmod 777 it. This impacts confidentiality, integrity, and availability. It is patched in versions 17.2.8, 18.2.5, and 19.2.3.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6321 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6321-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     June 03, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : ceph     CVE ID         : CVE-2024-31884 CVE-2024-47866 CVE-2025-52555     Debian Bug     : 1108410 1120797 1126573

    Multiple vulnerabilities were discovered in Ceph, a distributed storage     and file system, which may result in privilege escalation, denial of     service or information disclosure.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 16.2.15+ds-0+deb12u2.

    For the stable distribution (trixie), these problems have been fixed in     version 18.2.7+ds-1+deb13u1.

    We recommend that you upgrade your ceph packages.

    For the detailed security status of ceph please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/ceph

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2769 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous security and bug fixes. Space precludes documenting all of these     changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on     the most significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/7/html/7.1_release_notes

    ==========================================     IMPORTANT:
    The Red Hat Ceph Storage team has migrated our defect tracking from Bugzilla to an internal Jira system.
    Bug fixes and CVE information that was previously listed in the errata releases are now listed in the     Release Notes.

    During the migration period, some defect details might still appear temporarily in the Errata. However,     the release notes contain the most current and authoritative information, including the complete list of     fixes and security updates.

    Refer to the release notes going forward for the latest and most accurate fix and CVE information.
    ==========================================

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1536 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform     that combines the most stable version of the Ceph storage system with a     Ceph management platform, deployment utilities, and support services.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4310 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4310-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     September 25, 2025                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ceph     Version        : 14.2.21-1+deb11u1     CVE ID         : CVE-2021-3979 CVE-2022-3650 CVE-2023-43040 CVE-2025-52555     Debian Bug     : 1024932 1053690 1108410

    Ceph a distributed filesystem was affected by multiple vulnerabilties

    CVE-2021-3979

        A key length flaw was found in Ceph Storage component.
        An attacker can exploit the fact that the key length is incorrectly         passed in an encryption algorithm to create a non random key,         which is weaker and can be exploited for loss of confidentiality         and integrity on encrypted disks.

    CVE-2022-3650

        A privilege escalation flaw was found in Ceph. Ceph-crash.service allows         a local attacker to escalate privileges to root in the form of a crash         dump, and dump privileged information.

    CVE-2023-43040

        A flaw was found in Ceph RGW. An unprivileged         user can write to any bucket(s) accessible by a given key         if a POST's form-data contains a key called 'bucket'         with a value matching the name of the bucket used to sign         the request. The result of this is that a user could actually         upload to any bucket accessible by the specified access key         as long as the bucket in the POST policy matches the bucket         in said POST form part.

    CVE-2025-52555

        An unprivileged user can escalate to root privileges         in a ceph-fuse mounted CephFS by chmod 777 a directory owned         by root to gain access. The result of this is that a user could         read, write and execute to any directory owned by root as long         as they chmod 777 it. This impacts confidentiality,         integrity, and availability.

    For Debian 11 bullseye, these problems have been fixed in version     14.2.21-1+deb11u1.

    We recommend that you upgrade your ceph packages.

    For the detailed security status of ceph please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ceph

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4,     and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted     CephFS by chmod 777 a directory owned by root to gain access. The result of this is that a user could     read, write and execute to any directory owned by root as long as they chmod 777 it. This impacts     confidentiality, integrity, and availability. It is patched in versions 17.2.8, 18.2.5, and 19.2.3.
    (CVE-2025-52555)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
318559	Debian dsa-6321 : ceph - security update	Nessus	Debian Local Security Checks	medium
299273	RHEL 8 / 9 : Red Hat Ceph Storage 7.1 (RHSA-2026:2769)	Nessus	Red Hat Local Security Checks	high
297118	RHEL 10 / 9 : Red Hat Ceph Storage 9.0 Security and Enhancement update (Moderate) (RHSA-2026:1536)	Nessus	Red Hat Local Security Checks	high
265944	Debian dla-4310 : ceph - security update	Nessus	Debian Local Security Checks	critical
244949	Linux Distros Unpatched Vulnerability : CVE-2025-52555	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-52555

medium

Tenable Plugins

medium

high

high

critical

medium