CVE-2026-50152
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Ceph before versions 20.2.4 and 19.2.6 has a flaw in the Monitor subscription handler that allows a user with only read-only capabilities (mon allow r) to read the entire configuration-key store. This store contains sensitive secrets, including LUKS disk-encryption passphrases and the cephadm SSH private key.
Risk Assessment
A low-privileged account can escalate to full cluster and host compromise, as the SSH key grants root access to all nodes.
Recommendation
Upgrade Ceph to version 20.2.4 or 19.2.6, which include the fix.
Other vulnerabilities in Ceph
See all- CVE-2026-54330High
Ceph versions prior to 20.2.4 and 19.2.6, in the RGW SigV4 handler, do not reject requests carrying x-amz-* headers absent from the signed header set. This allows anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW honors, potentially leading to privilege escalation.
- CVE-2026-39944High
Ceph versions prior to 20.2.4 and 19.2.6, in RADOS Gateway (RGW), protect STS session tokens with AES-128-CBC without message authentication, allowing an attacker holding a valid STS token to tamper with it undetected and escalate to full RGW administrative access.
- CVE-2025-30156High
Ceph versions prior to 20.2.4 and 19.2.6 use the CephX authentication protocol with AES-128-CBC in an unauthenticated mode, using a hard-coded initialization vector and no message authentication. An attacker with a low-privilege key can forge tickets and gain cluster-wide access, including to privileged components such as Manager, MDS, and OSD.
Original NVD description (English source)
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6
Vulnerability data from NVD (NIST) · CISA KEV · EPSS