BIT-ceph-2026-50152

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/ceph/BIT-ceph-2026-50152.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-ceph-2026-50152
Aliases
Published
2026-09-02T14:37:34Z
Modified
2026-09-02T16:25:32Z
Summary
Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
Details

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  mon allow r capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6

Database specific 
{
    "cpes": [
        "cpe:2.3:a:linuxfoundation:ceph:*:*:*:*:*:*:*:*"
    ],
    "severity": "Critical"
}
References

Affected packages

Bitnami / ceph

Package

Name
ceph
Purl
pkg:bitnami/ceph

Severity

  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
19.0.0
Fixed
19.2.6
Introduced
20.0.0
Fixed
20.2.4

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/ceph/BIT-ceph-2026-50152.json"