CVE-2026-50152: falha crítica em ceph
Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.2%
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Produtos afetados
ceph · cephCVEs relacionadas — ceph
No mesmo produto, das mais perigosas para as menos.
CVE-2024-47866HIGHRGW DoS attack with empty HTTP header in S3 object copyEPSS 0.5%CVE-2026-54330HIGHCeph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalationEPSS 0.4%CVE-2026-39944HIGHCeph: CephX AES Authentication errorEPSS 0.3%CVE-2024-48916HIGHCeph is vulnerable to authentication bypass through RadosGWEPSS 0.2%CVE-2025-52555MEDIUMCephFS Permission Escalation Vulnerability in Ceph Fuse mounted FSEPSS 0.2%CVE-2025-30156HIGHCeph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgeryEPSS 0.1%