Read the docs
TI-2026-36920 Aliases CVE-2026-50152

Improper authorization in ceph

Priority MEDIUM 41CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · Low
Fix status
Partial Red Hat: 3 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-285.

Summary

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00248 16th percentileScored 2026-11-07
Fix Partial ceph (ceph): 19.2.6, 20.2.4Red Hat: 4 advisoriesRed Hat: 3 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cephceph19.0.0 to before 19.2.6; 20.0.0 to before 20.2.419.2.6, 20.2.4Patch availableCNA
  • ceph Vendorceph Affected 19.0.0 to before 19.2.6; 20.0.0 to before 20.2.4 Fixed in 19.2.6, 20.2.4 Patch available CNA

Remediation

  • Fix · CNA ceph (ceph) Fixed in 19.2.6, 20.2.4

Red Hat 4 advisories

  • RHSA-2026:86618 Released 2026-10-21 · Red Hat rating Critical
    New container image: rhceph-9.2
    • Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
  • RHSA-2026:83548 Released 2026-10-15 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
  • RHSA-2026:79243 Released 2026-10-08 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
Show 1 more Red Hat advisories
  • RHSA-2026:79101 Released 2026-10-08 · Red Hat rating Important
    Red Hat Ceph Storage 8.1 security and bug fix updates
    • Red Hat Ceph Storage 8.1 Tools ceph-2:19.2.1-423.el9cp, ceph-base-2:19.2.1-423.el9cp, ceph-common-2:19.2.1-423.el9cp +25

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 4AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 5AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7.1Fixed RHSA-2026:83548
Red Hat Ceph Storage 8.1Fixed RHSA-2026:79243
Red Hat Ceph Storage 9.2Fixed RHSA-2026:86618
Not affected: 3 products
  • Red Hat Ceph Storage 7.1
  • Red Hat Ceph Storage 8.1
  • Red Hat Ceph Storage 9.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50152
  2. 2026-10-09 Fix available: RHSA-2026:79101 · Red Hat
  3. 2026-10-09 Fix available: RHSA-2026:79243 · Red Hat
  4. 2026-10-09 Fix available: Red Hat Ceph Storage 8.1 · Red Hat
  5. 2026-10-16 Fix available: RHSA-2026:83548 · Red Hat
  6. 2026-10-16 Fix available: Red Hat Ceph Storage 7.1 · Red Hat
  7. 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
  8. 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat

References

Other 3

  • TI-2024-32613 Ceph is vulnerable to authentication bypass through RadosGW CVSS 3.1HIGH 8.1
  • TI-2024-32120 RGW DoS attack with empty HTTP header in S3 object copy CVSS 3.1HIGH 7.5
  • TI-2020-01660 Hard-coded credentials in ceph-ansible CVSS 3.1HIGH 8.8
  • TI-2018-07675 Improper authorization in Red Hat ceph CVSS 3.0HIGH 8.1
  • TI-2026-28807 Ceph: CephX AES Authentication error CVSS 3.1HIGH 8.8
  • TI-2019-07542 Improper handling of exceptional conditions in ceph CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences