Ceph CVEs – keyring rotation strongly advised, probably required in the future

[UweSauter]

https://www.openwall.com/lists/oss-security/2026/08/19/4
https://www.openwall.com/lists/oss-security/2026/08/20/20

;tldr There are flaws in the currently used authentication mechanism for CephX. Versions 19.2.6 and 20.2.4 introduce new algorithms to CephX that require a rotation of the keyrings.

What would be the steps to rotate the keyrings on a PVE cluster? Would this require a maintenance of the whole cluster or could it be done gradually?

Even if the old authentication scheme is supported for some coming versions we'll eventually come to the point where existing clusters need to be migrated to the new scheme.

Thanks,

Uwe

 

[dakota.marshall]

I am also curious about what the "official" way to do this is.

It doesnt appear that PVE lets you rotate the keyring from the UI, so it seems to me like the current process is to create a new client keyring with the upgraded crypto, create a new storage pool in PVE with the new keyring, and migrate storage over?? This doesnt seem ideal so I would love to know if there is a better way.

 

[t.lamprecht]

What would be the steps to rotate the keyrings on a PVE cluster? Would this require a maintenance of the whole cluster or could it be done gradually?

This can be done gradually, but needs a bit of care. We're currently in the process of finishing a mgiration helper tool and providing documentation for how to do this.