CVE-2023-43040 is a medium severity (CVSS 6.5) flaw in the Ceph RADOS Gateway as used by IBM Fusion HCI 2.5.2 through 2.7.2. An attacker could perform unauthorized actions because of improper bucket access. IBM's fix is to upgrade Fusion HCI to 2.8.0 and then upgrade the Data Foundation service.
What's affected
The record names IBM Spectrum Fusion HCI versions 2.5.2 through 2.7.2. IBM's bulletin, first published May 11, 2024, is titled for IBM Storage Fusion HCI and says Ceph is used by the product when it is configured with the Data Foundation service. That qualifier matters: a Fusion HCI system without Data Foundation does not run the affected component.
IBM's remediation is two steps. First upgrade IBM Storage Fusion HCI to version 2.8.0. Then upgrade the Fusion Data Foundation service. IBM links to the upgrade readme and to instructions for the Data Foundation upgrade. IBM lists no workarounds.
The weakness is CWE-1220, insufficient granularity of access control. The record also lists Debian LTS announcements as references, since Ceph is open source and is packaged by distributions. The vector shows a network path with high attack complexity.
How to check if you're exposed
Find out whether the Data Foundation service is installed on your Fusion HCI, and which version of the appliance software you run. In the OpenShift console that hosts Fusion HCI, the installed operators page lists the Data Foundation operator and its version. From a terminal with cluster access:
oc get csv -A | grep -i -E "odf|ocs|fusion"
Confirm the Fusion HCI version in the product's own interface and compare it with 2.8.0. If Ceph is deployed on its own elsewhere in your estate, check your Ceph and distribution advisories for the same CVE.
What to do now
- Confirm whether Data Foundation is enabled on each Fusion HCI system.
- Plan the upgrade of Fusion HCI to 2.8.0, then the Data Foundation upgrade, as IBM describes.
- Review bucket policies and access keys on object storage exposed by the cluster.
- Limit network access to the object gateway to the clients that need it.
- Check standalone Ceph clusters and distribution packages for the same CVE.
Why it matters
Object storage gateways make access decisions for each bucket. When the check on bucket access is too coarse, a caller can perform actions the bucket owner never meant to allow. The record's class, CWE-1220, covers that kind of gap in access control.
The vector rates confidentiality impact as none, integrity as high and availability as low, with high attack complexity, which gives a medium score of 6.5. IBM and the record agree on that score, so there is no conflict. The KEV flag is false. Upgrade on your normal maintenance window.
Quick check
Do I need to upgrade if I do not use Data Foundation?
IBM says Ceph is used when Fusion HCI is configured with Data Foundation, so the exposure depends on that service. Confirm your configuration before deciding.
Sources
- IBM Security Bulletin: IBM Storage Fusion HCI and Ceph RGW
- IBM X-Force Exchange entry 266807 (referenced in the record; content did not load when fetched)
- Debian LTS announcement 2023/10/msg00034 (referenced in the record; content did not load when fetched)
Last reviewed: 19 October 2026.
