https://www.openwall.com/lists/oss-security/2026/08/19/4
https://www.openwall.com/lists/oss-security/2026/08/20/20
;tldr There are flaws in the currently used authentication mechanism for CephX. Versions 19.2.6 and 20.2.4 introduce new algorithms to CephX that require a rotation of the keyrings.
What would be the steps to rotate the keyrings on a PVE cluster? Would this require a maintenance of the whole cluster or could it be done gradually?
Even if the old authentication scheme is supported for some coming versions we'll eventually come to the point where existing clusters need to be migrated to the new scheme.
Thanks,
Uwe
https://www.openwall.com/lists/oss-security/2026/08/20/20
;tldr There are flaws in the currently used authentication mechanism for CephX. Versions 19.2.6 and 20.2.4 introduce new algorithms to CephX that require a rotation of the keyrings.
What would be the steps to rotate the keyrings on a PVE cluster? Would this require a maintenance of the whole cluster or could it be done gradually?
Even if the old authentication scheme is supported for some coming versions we'll eventually come to the point where existing clusters need to be migrated to the new scheme.
Thanks,
Uwe
