Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-50152: Ceph lets read‑only users view cluster secret keys
CVE-2026-50152 · published 2 months ago
Summary
In older Ceph releases, a user with only read permission on the monitor could retrieve the entire configuration key store, which contains encryption passwords and the SSH key used by cephadm to access every node. This means a low‑privilege account could gain full control of the storage cluster and the underlying servers. Upgrade to Ceph 20.2.4 or 19.2.6 (or later) to close the gap.
What to do
- Update ceph to version 20.2.4.
- Update debian ceph to version 20.2.4+ds-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | ceph |
>= 20.0.0, < 20.2.4 Fix: upgrade to 20.2.4
|
| Debian:11 | debian | ceph | All versions |
| Debian:12 | debian | ceph | All versions |
| Debian:13 | debian | ceph | All versions |
| Debian:14 | debian | ceph |
< 20.2.4+ds-1 Fix: upgrade to 20.2.4+ds-1
|
| – | ceph | ceph | >= 19.0.0, < 19.2.6 |
| Ubuntu:Pro:14.04:LTS | canonical | ceph | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | ceph | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | ceph | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | ceph | All versions |
| Ubuntu:22.04:LTS | canonical | ceph | All versions |
| Ubuntu:24.04:LTS | canonical | ceph | All versions |
| Ubuntu:26.04:LTS | canonical | ceph | All versions |
Original advisory text
Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6
References
- https://security-tracker.debian.org/tracker/CVE-2026-50152 Vendor Advisory
- https://github.com/ceph/ceph/commit/d971bb2b6199f70b1708a20a63fa944ee7a94727 Patch
- https://github.com/ceph/ceph/commit/f2840d2fd338ab5de2865f0f78684bbf7b888c84 Patch
- https://ubuntu.com/security/CVE-2026-50152 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-50152 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50152... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-50152 Vendor Advisory
- https://github.com/ceph/ceph/security/advisories/GHSA-rg9p-5xcp-wm8h Third Party Advisory
- https://docs.ceph.com/en/latest/security/CVE-2026-50152/ Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-285Improper Authorization
Timeline
Published28 Aug 2026
Updated4 Nov 2026
First seen20 Aug 2026
Sources
DEBIAN-CVE-2026-50152 · OSV
CVE-2026-50152 · NVD
CVE-2026-50152 · MITRE
UBUNTU-CVE-2026-50152 · OSV
CVE-2026-50152 · OSV
GHSA-rg9p-5xcp-wm8h · GHSA
Track software like this
Free during beta