Ceph: Urgent Security Update for Squid and Tentacle

The Ceph project has released two security-related hotfixes: Squid 19.2.6 and Tentacle 20.2.4. Operators of Ceph clusters should update immediately.

* Update from September 9, 2026 *

Proxmox has provided a script for the necessary Ceph security migration and also notes the upcoming EOL of Ceph Squid 19.2: Ceph Squid 19.2. hin:
Go to the Proxmox Forum
Proxmox also notes that a Ceph network that is not connected to an unprotected network faces a less critical security risk.
Go to the Proxmox Forum

The new Ceph versions address a total of four security vulnerabilities (CVEs) affecting, among other things, CephX authentication, the RADOS Gateway (RGW), and the Ceph Monitor. CVE-2025-30156 is particularly relevant: This vulnerability allows an authentication bypass and requires CephX keys to be rotated as part of the update. To address this, Ceph is introducing a new key type called aes256k.

For cephadm and Rook, parts of the key rotation are automated; however, special attention must be paid to client keys and existing OpenStack integrations. Additional upgrade steps apply to RGW multisite environments. Ceph strongly recommends upgrading existing installations to Squid 19.2.6 or Tentacle 20.2.4 as soon as possible.

With PVE 9.2 and Ceph 20.2.4, RBD operations may currently fail due to the removal of the --auth_supported option. An official bug report has since been filed regarding this issue.

You can find information about the security vulnerability here

Additional links to check out:

Tips from the Proxmox Forum

A new migration script, which must be run once for the cluster, is available starting with PVE-Manager 9.2.12. The corresponding documentation is available starting with pve-docs version 9.2.5. They are currently still in the test repository but will be available shortly.

We're happy to assist you with upgrades and key rotation!