diff --git a/tcp_tests/tests/system/test_ceph_luminous_upgrade.py b/tcp_tests/tests/system/test_ceph_luminous_upgrade.py
index bf7346c..11b4da5 100644
--- a/tcp_tests/tests/system/test_ceph_luminous_upgrade.py
+++ b/tcp_tests/tests/system/test_ceph_luminous_upgrade.py
@@ -7,6 +7,24 @@
 LOG = logger.logger
 
 
+@pytest.fixture
+def wa_cve_2021_20288_global_id_reclaim(reclass_actions,
+                                        salt_actions):
+    tgt = "I@ceph:common"
+    context_file = "cluster/*/ceph/common.yml"
+    if not reclass_actions.check_existence(
+            'parameters.ceph.common.config.mon.'
+            + 'auth_allow_insecure_global_id_reclaim'):
+        reclass_actions.add_bool_key(
+            'parameters.ceph.common.config.mon.'
+            + 'auth_allow_insecure_global_id_reclaim', "False", context_file)
+        salt_actions.run_state(tgt, "state.apply", "ceph.common")
+        salt_actions.cmd_run(tgt, "systemctl restart ceph-mon.target")
+    else:
+        LOG.info("Skipping WA ceph set auth_allow_insecure_global_id_reclaim")
+
+
+@pytest.mark.usefixtures("wa_cve_2021_20288_global_id_reclaim")
 class TestCephLuminousUpgrade(object):
 
     @pytest.mark.grab_versions
@@ -17,7 +35,7 @@
         """ Upgrade Ceph luminous to nautilus
 
         Scenario:
-            1. Chenge parameters in reclass
+            1. Change parameters in reclass
             2. Run Pipeline Ceph - upgrade
         https://docs.mirantis.com/mcp/master/mcp-operations-guide/ update-upgrade/major-upgrade/ceph-upgrade/upgrade-ceph.html
         """  # noqa: E501
diff --git a/tcp_tests/tests/system/test_mcp_update.py b/tcp_tests/tests/system/test_mcp_update.py
index c6033c1..74f2f95 100644
--- a/tcp_tests/tests/system/test_mcp_update.py
+++ b/tcp_tests/tests/system/test_mcp_update.py
@@ -125,6 +125,23 @@
 
 
 @pytest.fixture
+def wa_cve_2021_20288_global_id_reclaim(reclass_actions,
+                                        salt_actions):
+    tgt = "I@ceph:common"
+    context_file = "cluster/*/ceph/common.yml"
+    if not reclass_actions.check_existence(
+            'parameters.ceph.common.config.mon.'
+            + 'auth_allow_insecure_global_id_reclaim'):
+        reclass_actions.add_bool_key(
+            'parameters.ceph.common.config.mon.'
+            + 'auth_allow_insecure_global_id_reclaim', "False", context_file)
+        salt_actions.run_state(tgt, "state.apply", "ceph.common")
+        salt_actions.cmd_run(tgt, "systemctl restart ceph-mon.target")
+    else:
+        LOG.info("Skipping WA ceph set auth_allow_insecure_global_id_reclaim")
+
+
+@pytest.fixture
 def wa_for_alerta_password_prod35958(reclass_actions,
                                      salt_actions):
 
@@ -170,7 +187,8 @@
 @pytest.mark.usefixtures("switch_to_proposed_pipelines",
                          "update_to_tag",
                          "wa_for_galera_clustercheck_password_prod35705",
-                         "wa_for_alerta_password_prod35958")
+                         "wa_for_alerta_password_prod35958",
+                         "wa_cve_2021_20288_global_id_reclaim")
 class TestUpdateMcpCluster(object):
     """
     Following the steps in