{"id":"CVE-2026-50152","aliases":["BIT-ceph-2026-50152","DEBIAN-CVE-2026-50152","EUVD-2026-67274","GHSA-rg9p-5xcp-wm8h","MGASA-2026-0389","RHSA-2026:79101","UBUNTU-CVE-2026-50152"],"status":"published","title":"Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00248,"percentile":0.16175,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285"],"published":"2026-08-27T20:53:42Z","modified":"2026-10-28T02:30:23Z","fixes":[{"ecosystem":"Bitnami","package":"ceph","fixed_in":["19.2.6","20.2.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ceph","fixed_in":["20.2.4+ds-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"ceph","ranges":[{"type":"SEMVER","events":[{"introduced":"19.0.0"},{"fixed":"19.2.6"},{"introduced":"20.0.0"},{"fixed":"20.2.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.2.11+ds-2","16.2.11+ds-3","16.2.11+ds-4","16.2.11+ds-5","16.2.11+ds-5.1","16.2.15+ds-0+deb12u1","16.2.15+ds-0+deb12u2","18.2.0+ds-1","18.2.0+ds-2","18.2.0+ds-3","18.2.0+ds-4","18.2.0+ds-5","18.2.0+ds-6","18.2.0+ds-7","18.2.0+ds-8","18.2.1+ds-1","18.2.1+ds-2","18.2.1+ds-3","18.2.1+ds-4","18.2.1+ds-5","18.2.1+ds-6","18.2.1+ds-7","18.2.1+ds-8","18.2.1+ds-9","18.2.3+ds-1","18.2.3+ds-2","18.2.3+ds-3","18.2.3+ds-3+loong64","18.2.4+ds-1","18.2.4+ds-10","18.2.4+ds-11","18.2.4+ds-12","18.2.4+ds-13","18.2.4+ds-2","18.2.4+ds-3","18.2.4+ds-4","18.2.4+ds-5","18.2.4+ds-6","18.2.4+ds-7","18.2.4+ds-8","18.2.4+ds-9","18.2.6-1","18.2.7+ds-1","18.2.7+ds-1.1","18.2.7-1","18.2.7-2","18.2.8+ds-1","18.2.8+ds-2","18.2.8+ds-2.1","20.2.2+ds-1","20.2.2+ds-10","20.2.2+ds-11","20.2.2+ds-12","20.2.2+ds-13","20.2.2+ds-2","20.2.2+ds-3","20.2.2+ds-4","20.2.2+ds-5","20.2.2+ds-6","20.2.2+ds-7","20.2.2+ds-8","20.2.2+ds-9","20.2.4+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.2.7+ds-1","18.2.7+ds-1+deb13u1","18.2.7+ds-1.1","18.2.8+ds-1","18.2.8+ds-2","18.2.8+ds-2.1","20.2.2+ds-1","20.2.2+ds-10","20.2.2+ds-11","20.2.2+ds-12","20.2.2+ds-13","20.2.2+ds-2","20.2.2+ds-3","20.2.2+ds-4","20.2.2+ds-5","20.2.2+ds-6","20.2.2+ds-7","20.2.2+ds-8","20.2.2+ds-9","20.2.4+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.2.4+ds-1"}]}],"versions":["18.2.7+ds-1","18.2.7+ds-1.1","18.2.8+ds-1","18.2.8+ds-2","18.2.8+ds-2.1","20.2.2+ds-1","20.2.2+ds-10","20.2.2+ds-11","20.2.2+ds-12","20.2.2+ds-13","20.2.2+ds-2","20.2.2+ds-3","20.2.2+ds-4","20.2.2+ds-5","20.2.2+ds-6","20.2.2+ds-7","20.2.2+ds-8","20.2.2+ds-9"]},{"source":"osv","ecosystem":"Mageia:10","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.2.4-1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-exporter-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-immutable-object-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-immutable-object-cache-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-mds-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-mgr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-mib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-mon-client-nvmeof-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-mon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-osd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-radosgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"ceph-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"cephadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"cephfs-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"cephfs-top","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephfs-daemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephfs-proxy2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephfs-proxy2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephfs2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libcephsqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librados-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librados2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libradospp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"libradosstriper1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librbd1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"librgw2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-ceph-argparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-cephfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-rados-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-rbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"python3-rgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"rbd-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"rbd-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"rbd-nbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ceph_storage:8.1::el9","package":"rbd-nbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.2.1-423.el9cp"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.67.4-0ubuntu2","0.67.4-0ubuntu3","0.72-0ubuntu1","0.72.1-0ubuntu1","0.72.1-2","0.72.1-3","0.72.2-1","0.72.2-2","0.78-0ubuntu1","0.79-0ubuntu1","0.80.1-0ubuntu1","0.80.1-0ubuntu1.1","0.80.5-0ubuntu0.14.04.1","0.80.7-0ubuntu0.14.04.1","0.80.9-0ubuntu0.14.04.1","0.80.9-0ubuntu0.14.04.2","0.80.10-0ubuntu0.14.04.1","0.80.10-0ubuntu1.14.04.2","0.80.10-0ubuntu1.14.04.3","0.80.11-0ubuntu1.14.04.1","0.80.11-0ubuntu1.14.04.2","0.80.11-0ubuntu1.14.04.3","0.80.11-0ubuntu1.14.04.4","0.80.11-0ubuntu1.14.04.4+esm2","0.80.11-0ubuntu1.14.04.4+esm3","0.80.11-0ubuntu1.14.04.4+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.94.3-0ubuntu2","0.94.5-0ubuntu1","9.2.0-0ubuntu3","9.2.0-0ubuntu4","9.2.0-0ubuntu5","9.2.0-0ubuntu6","10.0.2-0ubuntu1","10.0.3-0ubuntu1","10.0.5-0ubuntu1","10.1.0-0ubuntu1","10.1.1-0ubuntu1","10.1.2-0ubuntu1","10.2.0-0ubuntu0.16.04.1","10.2.0-0ubuntu0.16.04.2","10.2.2-0ubuntu0.16.04.2","10.2.3-0ubuntu0.16.04.2","10.2.5-0ubuntu0.16.04.1","10.2.6-0ubuntu0.16.04.1","10.2.7-0ubuntu0.16.04.1","10.2.9-0ubuntu0.16.04.1","10.2.10-0ubuntu0.16.04.1","10.2.11-0ubuntu0.16.04.1","10.2.11-0ubuntu0.16.04.2","10.2.11-0ubuntu0.16.04.3","10.2.11-0ubuntu0.16.04.3+esm1","10.2.11-0ubuntu0.16.04.3+esm2","10.2.11-0ubuntu0.16.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.2.0-0ubuntu1","12.2.1-0ubuntu1","12.2.2-0ubuntu1","12.2.2-0ubuntu2","12.2.4-0ubuntu1","12.2.4-0ubuntu1.1","12.2.7-0ubuntu0.18.04.1","12.2.8-0ubuntu0.18.04.1","12.2.8-0ubuntu0.18.04.2","12.2.11-0ubuntu0.18.04.1","12.2.11-0ubuntu0.18.04.2","12.2.12-0ubuntu0.18.04.1","12.2.12-0ubuntu0.18.04.2","12.2.12-0ubuntu0.18.04.3","12.2.12-0ubuntu0.18.04.4","12.2.12-0ubuntu0.18.04.5","12.2.13-0ubuntu0.18.04.2","12.2.13-0ubuntu0.18.04.3","12.2.13-0ubuntu0.18.04.4","12.2.13-0ubuntu0.18.04.5","12.2.13-0ubuntu0.18.04.6","12.2.13-0ubuntu0.18.04.7","12.2.13-0ubuntu0.18.04.8","12.2.13-0ubuntu0.18.04.10","12.2.13-0ubuntu0.18.04.11","12.2.13-0ubuntu0.18.04.11+esm1","12.2.13-0ubuntu0.18.04.11+esm2","12.2.13-0ubuntu0.18.04.11+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.2.2-0ubuntu3","14.2.2-0ubuntu4","14.2.4-0ubuntu1","14.2.4-0ubuntu2","14.2.4-0ubuntu3","15.1.0-0ubuntu2","15.1.0-0ubuntu3","15.1.1-0ubuntu1","15.2.0-0ubuntu1","15.2.0-0ubuntu2","15.2.1-0ubuntu1","15.2.1-0ubuntu2","15.2.3-0ubuntu0.20.04.1","15.2.3-0ubuntu0.20.04.2","15.2.5-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.2","15.2.8-0ubuntu0.20.04.1","15.2.11-0ubuntu0.20.04.2","15.2.12-0ubuntu0.20.04.1","15.2.13-0ubuntu0.20.04.1","15.2.13-0ubuntu0.20.04.2","15.2.14-0ubuntu0.20.04.1","15.2.14-0ubuntu0.20.04.2","15.2.16-0ubuntu0.20.04.1","15.2.17-0ubuntu0.20.04.1","15.2.17-0ubuntu0.20.04.3","15.2.17-0ubuntu0.20.04.4","15.2.17-0ubuntu0.20.04.5","15.2.17-0ubuntu0.20.04.6","15.2.17-0ubuntu0.20.04.6+esm1","15.2.17-0ubuntu0.20.04.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.2.6-0ubuntu1","16.2.6-0ubuntu2","16.2.6-0ubuntu3","16.2.7-0ubuntu1","16.2.7-0ubuntu4","17.1.0-0ubuntu1","17.1.0-0ubuntu2","17.1.0-0ubuntu3","17.2.0-0ubuntu0.22.04.1","17.2.0-0ubuntu0.22.04.2","17.2.5-0ubuntu0.22.04.2","17.2.5-0ubuntu0.22.04.3","17.2.6-0ubuntu0.22.04.1","17.2.6-0ubuntu0.22.04.2","17.2.6-0ubuntu0.22.04.3","17.2.7-0ubuntu0.22.04.1","17.2.7-0ubuntu0.22.04.2","17.2.9-0ubuntu0.22.04.1","17.2.9-0ubuntu0.22.04.2","17.2.9-0ubuntu0.22.04.3","17.2.9-0ubuntu0.22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.2.0-0ubuntu3","18.2.0-0ubuntu6","18.2.0-0ubuntu7","19.2.0~git20240301.4c76c50-0ubuntu3","19.2.0~git20240301.4c76c50-0ubuntu4","19.2.0~git20240301.4c76c50-0ubuntu6","19.2.0~git20240301.4c76c50-0ubuntu6.1","19.2.0-0ubuntu0.24.04.1","19.2.0-0ubuntu0.24.04.2","19.2.1-0ubuntu0.24.04.2","19.2.3-0ubuntu0.24.04.1","19.2.3-0ubuntu0.24.04.2","19.2.3-0ubuntu0.24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.2.0-0ubuntu2","20.2.1-0ubuntu1","20.2.1-0ubuntu3","20.2.4+ds-0ubuntu1","20.2.4+ds1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["19.2.1-0ubuntu3","19.2.3-0ubuntu2","19.2.3-0ubuntu3","19.2.3-0ubuntu4","20.2.0-0ubuntu1","20.2.0-0ubuntu2","20.2.0-0ubuntu2.1"]}],"products":[{"vendor":"ceph","product":"ceph"}],"references":[{"url":"https://github.com/ceph/ceph/security/advisories/GHSA-rg9p-5xcp-wm8h","tags":["x_refsource_CONFIRM","web","advisory","report"]},{"url":"https://github.com/ceph/ceph/commit/d971bb2b6199f70b1708a20a63fa944ee7a94727","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/ceph/ceph/commit/f2840d2fd338ab5de2865f0f78684bbf7b888c84","tags":["x_refsource_MISC","web","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50152","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50152.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-50152","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0389.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36147","tags":["report"]},{"url":"https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.html#upgrading-and-rotating-cephx-keys","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/19/4","tags":["web"]},{"url":"https://github.com/ceph/ceph/security/advisories/GHSA-rmjq-ffrm-j6vj","tags":["advisory"]},{"url":"https://docs.ceph.com/en/latest/security/CVE-2025-30156/","tags":["advisory"]},{"url":"https://web.mit.edu/tlyu/papers/krb4peril-ndss04.pdf","tags":["web"]},{"url":"https://docs.ceph.com/en/latest/security/CVE-2026-50152/","tags":["advisory","report"]},{"url":"https://docs.ceph.com/en/latest/security/CVE-2026-54330","tags":["advisory"]},{"url":"https://github.com/ceph/ceph/security/advisories/GHSA-j73r-qrgx-jvq2","tags":["advisory"]},{"url":"https://docs.ceph.com/en/latest/security/CVE-2026-39944","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:79101","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2393864","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519431","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79101.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-48795","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-48795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795","tags":["advisory"]},{"url":"https://access.redhat.com/solutions/7071748","tags":["article"]},{"url":"https://terrapin-attack.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-48916","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-48916","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48916","tags":["advisory"]},{"url":"https://github.com/ceph/ceph/pull/60624/commits/919da3696668a07c6810dfa39301950c81c2eba4","tags":["article"]},{"url":"https://github.com/ceph/ceph/security/advisories/GHSA-5g9m-mmp6-93mq","tags":["article"]},{"url":"https://tracker.ceph.com/issues/68836","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30156","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30156","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30156","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39944","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39944","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39944","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50152","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54330","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54330","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54330","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-50152","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-50152","title":"Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6","status":"published","published":"2026-08-27T20:53:42.353Z","modified":"2026-09-01T14:48:11.476Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:20:08.734143Z"}],"euvd":[{"id":"EUVD-2026-67274","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6","status":"published","published":"2026-08-27T20:53:42Z","modified":"2026-09-01T14:48:11Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T18:01:18.264709Z"}],"nvd":[{"id":"CVE-2026-50152","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6","status":"published","published":"2026-08-28T00:18:07.073Z","modified":"2026-09-08T21:11:56.25Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-50152","title":"Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6","status":"published","published":"2026-08-27T20:53:42.353Z","modified":"2026-10-28T02:30:23.973629116Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"DEBIAN-CVE-2026-50152","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6","status":"published","published":"2026-08-28T00:18:07.073Z","modified":"2026-10-01T03:03:16.65280026Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:45:56.877408Z"},{"id":"RHSA-2026:79101","title":"Red Hat Security Advisory: Red Hat Ceph Storage 8.1 security and bug fix updates","status":"published","published":"2026-10-10T10:22:40Z","modified":"2026-10-17T10:20:31Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-50152","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6","status":"published","published":"2026-08-28T00:18:00Z","modified":"2026-10-17T12:58:33.455884846Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"BIT-ceph-2026-50152","title":"Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users","description":"Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6","status":"published","published":"2026-09-02T14:37:34.261Z","modified":"2026-09-02T16:25:32.498940746Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"MGASA-2026-0389","title":"Updated ceph packages fix security vulnerabilities","description":"Updated ceph packages fix various security issues allowing\nauthentication bypasses to gain admin privileges on the OSD, MDS, and\nMGR services. Notice that some of the fixes require kernel support for\naes256k (introduced in kernel 7). This update will not break installs\nusing the old (and insecure) AES keys; warnings will appear to migrate\nall keys (check out \"ceph health detail\" or \"ceph status\").\n","status":"published","published":"2026-09-09T23:52:21Z","modified":"2026-09-10T00:12:25.013579669Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}