The vulnerability resides in Ceph's authentication protocol, which encrypts tickets with AES-128-CBC in an unauthenticated mode. Because the encryption uses a hard‑coded initialization vector and provides no integrity checking, an attacker can modify ciphertext blocks to forge valid tickets. The compromised tickets allow the attacker to impersonate privileged entities such as Manager, MDS, and OSD, granting cluster‑wide access, or to flip a bit in a service ticket to grant unrestricted permissions. The weakness is a lack of message authentication for a cryptographic primitive.

Systems running Ceph versions earlier than 20.2.4 or 19.2.6 are affected. This includes the Ceph distributed storage platform distributed under the ceph:ceph vendor product. The fix is available in the aforementioned releases.

The CVSS score of 8.9 classifies the flaw as high severity. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits have been documented yet. However, the description indicates that an attacker who can observe CephX traffic and possesses a low‑privilege credential can use the monitor as an encryption oracle, demonstrating a realistic attack path. Given the authentication bypass and privilege escalation potential, the risk to affected systems is substantial. The likely attack vector is an authenticated observer who can sniff traffic, then manipulate ciphertext to forge tickets. The absence of a KEV listing does not mitigate the inherent risk posed by the vulnerability.