CVE-2026-50152

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50152", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-03T20:54:20.431Z", "datePublished": "2026-08-27T20:53:42.353Z", "dateUpdated": "2026-09-01T14:48:11.476Z"}, "containers": {"cna": {"title": "Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/ceph/ceph/security/advisories/GHSA-rg9p-5xcp-wm8h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ceph/ceph/security/advisories/GHSA-rg9p-5xcp-wm8h"}, {"name": "https://github.com/ceph/ceph/commit/d971bb2b6199f70b1708a20a63fa944ee7a94727", "tags": ["x_refsource_MISC"], "url": "https://github.com/ceph/ceph/commit/d971bb2b6199f70b1708a20a63fa944ee7a94727"}, {"name": "https://github.com/ceph/ceph/commit/f2840d2fd338ab5de2865f0f78684bbf7b888c84", "tags": ["x_refsource_MISC"], "url": "https://github.com/ceph/ceph/commit/f2840d2fd338ab5de2865f0f78684bbf7b888c84"}], "affected": [{"vendor": "ceph", "product": "ceph", "versions": [{"version": ">= 19.0.0, < 19.2.6", "status": "affected"}, {"version": ">= 20.0.0, < 20.2.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-27T20:53:42.353Z"}, "descriptions": [{"lang": "en", "value": "Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only \u00a0`mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6"}], "source": {"advisory": "GHSA-rg9p-5xcp-wm8h", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-01T03:56:17.495692Z", "id": "CVE-2026-50152", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T14:48:11.476Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50152", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-01T03:56:17.495692Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-28T15:06:12.054Z"}}], "cna": {"title": "Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users", "source": {"advisory": "GHSA-rg9p-5xcp-wm8h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ceph", "product": "ceph", "versions": [{"status": "affected", "version": ">= 19.0.0, < 19.2.6"}, {"status": "affected", "version": ">= 20.0.0, < 20.2.4"}]}], "references": [{"url": "https://github.com/ceph/ceph/security/advisories/GHSA-rg9p-5xcp-wm8h", "name": "https://github.com/ceph/ceph/security/advisories/GHSA-rg9p-5xcp-wm8h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ceph/ceph/commit/d971bb2b6199f70b1708a20a63fa944ee7a94727", "name": "https://github.com/ceph/ceph/commit/d971bb2b6199f70b1708a20a63fa944ee7a94727", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ceph/ceph/commit/f2840d2fd338ab5de2865f0f78684bbf7b888c84", "name": "https://github.com/ceph/ceph/commit/f2840d2fd338ab5de2865f0f78684bbf7b888c84", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only \u00a0`mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-27T20:53:42.353Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50152", "state": "PUBLISHED", "dateUpdated": "2026-09-01T14:48:11.476Z", "dateReserved": "2026-06-03T20:54:20.431Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-27T20:53:42.353Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ceph", "vendor": "ceph", "versions": [{"status": "affected", "version": ">= 19.0.0, < 19.2.6"}, {"status": "affected", "version": ">= 20.0.0, < 20.2.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only \u00a0`mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6"}], "id": "CVE-2026-50152", "lastModified": "2026-09-08T21:11:56.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.3, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50152", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-01T03:56:17.495692Z", "version": "2.0.3"}}]}, "published": "2026-08-28T00:18:07.073", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ceph/ceph/commit/d971bb2b6199f70b1708a20a63fa944ee7a94727"}, {"source": "security-advisories@github.com", "url": "https://github.com/ceph/ceph/commit/f2840d2fd338ab5de2865f0f78684bbf7b888c84"}, {"source": "security-advisories@github.com", "url": "https://github.com/ceph/ceph/security/advisories/GHSA-rg9p-5xcp-wm8h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ceph: ceph: MON subscription handler exposes config-key store to low-privilege CephX users", "id": "2519423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519423"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "status": "draft"}, "cwe": "CWE-862", "details": ["A flaw was found in the MON subscription handler of Ceph, a distributed storage system. The handler does not properly authorize access to the config-key store when processing MMonSubscribe messages. Any CephX user holding mon allow r capabilities can read the entire config-key store, which contains sensitive operational secrets including OSD LUKS disk encryption passphrases and, on clusters managed by cephadm, the SSH private key used to administer every host. Exposure of these secrets can lead to full host-level root access and compromise of encrypted data at rest."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-50152", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:4", "fix_state": "Fix deferred", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 4"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Fix deferred", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Fix deferred", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/rhceph-7-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "rhceph/rhceph-8-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph/rhceph-9-rhel9", "product_name": "Red Hat Ceph Storage 9"}], "public_date": "2026-08-19T17:57:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-50152\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50152"], "statement": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited from the adjacent cluster network with low-privilege CephX credentials and no user interaction. Successful exploitation allows an attacker to read the full MON config-key store, exposing OSD LUKS passphrases and cephadm SSH private keys, potentially yielding root access on all cluster hosts. The vulnerability's root cause is missing authorization checks in the MON subscription handler when serving config-key store contents.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ceph", "vendor": "ceph"}], "created": "2026-08-20T01:45:03.405106+00:00", "updated": "2026-08-28T06:45:04.396219+00:00", "vendors": ["ceph", "ceph$PRODUCT$ceph"]}