# CVE-2026-50152: Ceph authorization bypass in config-key store

Source: https://junglewise.ai/threats/cve-2026-50152-ceph-authorization-bypass-in-config-key-store  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-50152 · Severity: critical · CVSS 9.1 · Published 2026-08-28

Ceph is an open-source distributed storage platform used to manage and protect large volumes of data across clusters of servers. A flaw in the Monitor service allows any user with basic read-only access to the system to read all sensitive configuration data, including encryption passphrases and SSH private keys that grant root access to every host in the cluster. An attacker exploiting this can escalate from a low-privilege account to complete control over the entire storage system and underlying infrastructure.

Technologies: [Ceph](https://junglewise.ai/threats/technologies/ceph). Vendors: [Ceph](https://junglewise.ai/threats/vendors/ceph).

## Quick answers

**Is CVE-2026-50152 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50152 being exploited in the wild.

**How severe is CVE-2026-50152?** Critical severity, with a CVSS score of 9.1, published 28 August 2026.

**Which products and versions are affected?** Ceph prior to 20.2.4 and 19.2.6.

**Is there a fix for CVE-2026-50152?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50152 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-50152?** Check whether you run Ceph at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in Ceph's Monitor subscription handler that fails to properly validate access to the config-key store. Any CephX user with only `mon allow r` (read) capabilities can send a crafted MMonSubscribe message to read the entire config-key store without proper permission checks. The store contains sensitive secrets including OSD LUKS disk-encryption passphrases and, in cephadm-managed clusters, SSH private keys used for cluster administration. This allows privilege escalation from a read-only account to full cluster and host compromise. The issue is fixed in Ceph versions 20.2.4 and 19.2.6.

## Affected products

- Ceph Ceph prior to 20.2.4 and 19.2.6

## Timeline

- 2026-08-28: disclosed: CVE-2026-50152 published on NVD

## References

- [https://github.com/ceph/ceph/commit/d971bb2b6199f70b1708a20a63fa944ee7a94727](https://github.com/ceph/ceph/commit/d971bb2b6199f70b1708a20a63fa944ee7a94727)
- [https://github.com/ceph/ceph/commit/f2840d2fd338ab5de2865f0f78684bbf7b888c84](https://github.com/ceph/ceph/commit/f2840d2fd338ab5de2865f0f78684bbf7b888c84)

## Related threats

- [Ceph Object Gateway SigV4 signature bypass via unsigned headers](https://junglewise.ai/threats/cve-2026-54330-ceph-object-gateway-sigv4-signature-bypass-via-unsigned-headers)
- [Ceph RADOS Gateway STS token forgery via unauthenticated CBC mode](https://junglewise.ai/threats/cve-2026-39944-ceph-rados-gateway-sts-token-forgery-via-unauthenticated-cbc-mode)
- [Ceph CephX authentication credential forgery via unauthenticated encryption](https://junglewise.ai/threats/cve-2025-30156-ceph-cephx-authentication-credential-forgery-via-unauthenticated)