Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-50152— Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users

Quick assessment

Affected
ceph ceph
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ceph是Ceph社区开源的一款分布式存储系统。 Ceph 20.2.4之前版本和19.2.6之前版本存在授权问题漏洞，该漏洞源于Monitor订阅处理器未能正确授权访问配置密钥存储，可能允许仅具有 权限的CephX用户通过发送特制MMonSubscribe消息读取整个存储，导致敏感信息泄露和权限提升。

CVSS 9.1 · Critical EPSS 0.25% · P15

Affected Version Matrix 2

VendorProduct Version RangeStatus
ceph ceph >= 19.0.0, < 19.2.6 affected
>= 20.0.0, < 20.2.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-50152

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
Source: CVE Program / CVE List V5
Vulnerability Description
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Ceph 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ceph是Ceph社区开源的一款分布式存储系统。 Ceph 20.2.4之前版本和19.2.6之前版本存在授权问题漏洞，该漏洞源于Monitor订阅处理器未能正确授权访问配置密钥存储，可能允许仅具有`mon allow r`权限的CephX用户通过发送特制MMonSubscribe消息读取整个存储，导致敏感信息泄露和权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
ceph ceph >= 19.0.0, < 19.2.6 -

II. Public POCs for CVE-2026-50152

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-50152

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-50152 (2)

Vendor Advisories for CVE-2026-50152 (1)

Same Patch Batch · ceph · 2026-08-27 · 4 CVEs total

CVE-2025-30156 8.9 HIGH Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential for
CVE-2026-39944 8.8 HIGH Ceph: CephX AES Authentication error
CVE-2026-54330 8.1 HIGH Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing pr

IV. Related Vulnerabilities

Same product: ceph
Same vendor: ceph
Same weakness: CWE-285

V. Comments for CVE-2026-50152

No comments yet

Leave a comment