CVE-2026-50152

Received Received - Intake

Authorization Bypass in Ceph Monitor Configuration-Key Store

Publication date: 2026-08-28

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-50152

Affected Vendors & Products

Vendor	Product	Version / Range
ceph	ceph	to 19.2.6 (exc)
ibm	storage_ceph	to 19.2.6 (exc)
red_hat	red_hat_ceph_storage	to 19.2.6 (exc)
openshift	openshift_data_foundation	to 19.2.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor (MON) config-key store. It allows any CephX user with 'mon allow r' capabilities to read the entire MON config-key store by sending a crafted MMonSubscribe message. The store contains sensitive data like OSD LUKS passphrases and SSH private keys used by cephadm for host access.

Detection Guidance

To detect this vulnerability, check Ceph Monitor logs for unauthorized MMonSubscribe messages or unusual access to the config-key store. Use commands like 'ceph mon dump' to inspect monitor configurations and 'ceph auth list' to verify user capabilities. Monitor for any suspicious activity involving the 'kv:' subscription type.

Impact Analysis

An attacker with a low-privileged account can escalate to full cluster and host compromise. They can read sensitive secrets including disk-encryption passphrases and SSH private keys, granting root access on every node in cephadm-managed clusters under default configurations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data such as OSD LUKS disk-encryption passphrases and SSH private keys, which are critical for data protection and access control. Exposure of such data may violate GDPR's data security requirements and HIPAA's safeguards for protected health information, potentially resulting in non-compliance with these regulations.

Mitigation Strategies

Upgrade Ceph to versions 20.2.4 or 19.2.6 or later immediately. Remove or restrict 'mon allow r' capabilities from low-privileged users. Audit all CephX user permissions and revoke unnecessary access. Monitor for any signs of compromise, especially SSH key exposure.

Hi! I’m here to help you understand CVE-2026-50152. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70