Executive brief
Ceph is an open-source distributed storage platform used to manage and protect large volumes of data across clusters of servers. A flaw in the Monitor service allows any user with basic read-only access to the system to read all sensitive configuration data, including encryption passphrases and SSH private keys that grant root access to every host in the cluster. An attacker exploiting this can escalate from a low-privilege account to complete control over the entire storage system and underlying infrastructure.
Technical details
The vulnerability is an authorization bypass in Ceph's Monitor subscription handler that fails to properly validate access to the config-key store. Any CephX user with only `mon allow r` (read) capabilities can send a crafted MMonSubscribe message to read the entire config-key store without proper permission checks. The store contains sensitive secrets including OSD LUKS disk-encryption passphrases and, in cephadm-managed clusters, SSH private keys used for cluster administration. This allows privilege escalation from a read-only account to full cluster and host compromise. The issue is fixed in Ceph versions 20.2.4 and 19.2.6.
Affected products
- Ceph Ceph prior to 20.2.4 and 19.2.6
Timeline
- 2026-08-28: disclosed: CVE-2026-50152 published on NVD