CVE-2018-1128

CSIRTS triage

What

Cephx authentication protocol does not properly verify clients and is vulnerable to replay attacks.

Who is affected

Ceph cluster deployments where attackers have network access to sniff cluster traffic.

Urgency

High priority; unauthenticated cluster access possible via replay; remediation critical.

Action

Patch Ceph to version with cephx replay protection and credential validation fixes.

AI-assisted analysis generated from the source advisory — verify against the original.

Exploitation outlook

• Low exploitation risk0.99% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 59% of all EPSS-scored CVEs.

Advisory coverage (1)

• unknownCVE-2018-1128: It was found that cephx authentication protocol did not verify ceph clients correctly and was v…msrc · 2026-08-06

External references

NVD record for CVE-2018-1128

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2018-1128 status](https://www.csirts.com/badge/CVE-2018-1128)](https://www.csirts.com/cve/CVE-2018-1128)