# \[CVE\] \[URGENT\] Squid v19.2.6 and Tentacle v20.2.4 released

DevFeed: [\[CVE\] \[URGENT\] Squid v19.2.6 and Tentacle v20.2.4 released](<https://devfeed.tech/articles/cve-urgent-squid-v19-2-6-and-tentacle-v20-2-4-released-12345.md>)

Original publisher: [Read original article](<https://ceph.io/en/news/blog/2026/v20-2-4-v19-2-6-combo-released/>)

Author: Patrick Donnelly

Published: 2026-08-19T00:00:00Z

Content type: release

Language: en

Sources: [Ceph Blog](<https://devfeed.tech/sources/ceph-blog.md>)

Topics: [releases](<https://devfeed.tech/topics/releases.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [client](<https://devfeed.tech/topics/client.md>), [monitor](<https://devfeed.tech/topics/monitor.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [blog-post](<https://devfeed.tech/tags/blog-post.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cves](<https://devfeed.tech/tags/cves.md>), [en-article](<https://devfeed.tech/tags/en-article.md>), [en-blog-post](<https://devfeed.tech/tags/en-blog-post.md>), [errors](<https://devfeed.tech/tags/errors.md>), [linux](<https://devfeed.tech/tags/linux.md>), [process](<https://devfeed.tech/tags/process.md>), [release](<https://devfeed.tech/tags/release.md>), [releases](<https://devfeed.tech/tags/releases.md>), [rest](<https://devfeed.tech/tags/rest.md>), [rgw](<https://devfeed.tech/tags/rgw.md>), [squid](<https://devfeed.tech/tags/squid.md>), [tentacle](<https://devfeed.tech/tags/tentacle.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>)

## AI overview

The Ceph project released Tentacle 20.2.4 and Squid 19.2.6 as hotfixes addressing four CVEs. The article urgently recommends upgrading and explains changes to CephX key types, daemon-key rotation, authentication controls, recovery procedures, and multisite RGW request signing.

## Source excerpt

The Ceph project has released Tentacle 20.2.4 and Squid 19.2.6 hotfixes for four CVEs across several components. This is the sixth backport release in the Squid series. This is the fourth backport release in the Tentacle series. We strongly recommend that all Ceph operators upgrade to one of these releases as soon as possible. Release Date ¶ August 19, 2026 Critical Upgrade Steps ¶ The fix for CVE-2025-30156 introduces a new CephX key type, aes256k. This is the first time Ceph has introduced a new key type for CephX credentials. Therefore, a new procedure exists for upgrading and rotating Ceph daemon keys as part of this CVE. Before upgrading a Ceph cluster, the operator should familiarize themselves with the procedure to upgrade CephX keys. These steps are for package-based deployments of Ceph. In other sections, the document also includes new information about key rotation procedures, monitor authentication controls, and emergency recovery procedures. Deployments using cephadm will automate the process except for client keys. You may notice that Cephadm spends more time than normal on the upgrade after updating all daemon images. This is due to a new process rotating the OSD and MDS keys. Please be patient. There are plans to improve this in the future. Deployments using Rook will also automate rotation of some client keys with some exclusions. Look to the Rook project's announcement for more details. Client and kernel upgrades are recommended to support aes256k. Note that upstream Linux kernel client support began in kernel 7.0 and has been backported to CentOS Stream 9 and 10. Check with your distribution vendor for backported key support before rotating client keys used by the kernel. As part of upgrading a Ceph cluster, six new health warnings and errors will be generated. This is normal. As part of the process to upgrade/rotate entity keys, you will address the warnings and errors as you go. These are documented beginning here. The CephX documentation has bee