Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109411— Samba: access control bypass via vfs_ceph_rgw case-insensitive open

Quick assessment

Affected
Samba Samba
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Samba 的 vfs_ceph_rgw 模块的 openat() 函数中发现了一个访问控制绕过漏洞。经过身份验证的用户可以绕过访问控制，读取或覆盖已配置为使用实验性 vfs_ceph_rgw 模块的共享目录中的受限文件。当客户端使用不匹配的字符大小写请求一个已存在的文件时，该模块无法正确执行不区分大小写的查找，导致服务器将该操作误判为创建新文件。因此，服务器跳过了对现有文件的标准权限检查，使得攻击者能够访问或覆盖其他用户拥有的敏感数据。

CVSS 8.1 · High

Affected Version Matrix 9

VendorProduct Version RangeStatus
Red Hat Red Hat Enterprise Linux 10 any unaffected
Red Hat Red Hat Enterprise Linux 6 any unaffected
any unaffected
Red Hat Red Hat Enterprise Linux 7 any unaffected
Red Hat Red Hat Enterprise Linux 8 any unaffected
Red Hat Red Hat Enterprise Linux 9 any unaffected
Red Hat Red Hat OpenShift Container Platform 4 any unaffected
any unaffected
Samba Samba 4.25.0< 4.25.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109411

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Samba: access control bypass via vfs_ceph_rgw case-insensitive open
Source: CVE Program / CVE List V5
Vulnerability Description
An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Samba Samba 4.25.0 ~ 4.25.1 -
Red Hat Red Hat Enterprise Linux 10 - cpe:/o:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Red Hat Red Hat Enterprise Linux 8 - cpe:/o:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/o:redhat:enterprise_linux:9
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4

II. Public POCs for CVE-2026-109411

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109411

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-109411 (4)

Other References for CVE-2026-109411 (1)

IV. Related Vulnerabilities

Same product: Samba
Same vendor: Samba
Same weakness: CWE-178