CVE-2026-50152 Missing authorization in ceph
Low-privileged Ceph users can read sensitive cluster secrets, including SSH keys, leading to full cluster and host compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50152?
CVE-2026-50152 is a critical missing authorization vulnerability in ceph, published on 27 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6
Weakness: CWE-285
Which versions are affected by CVE-2026-50152?
1 open source package ship an affected version, including ceph.
| Package | Affected | Fixed in |
|---|---|---|
ceph Bitnami | From 19.0.0 | 19.2.6, 20.2.4 |
How do I fix CVE-2026-50152?
Upgrade ceph to a fixed version for your release line: 19.2.6 or 20.2.4.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-50152 being exploited?
There is no known exploitation of CVE-2026-50152 in the wild and no public exploit code.
Sources
Also known as BIT-ceph-2026-50152, DEBIAN-CVE-2026-50152, ECHO-c8d6-5e39-6e63, GHSA-rg9p-5xcp-wm8h, MINI-j88f-4683-57pg, MINI-w7vr-v57v-43j2 and 1 more.