CVE-2026-50152 Overview
Ceph is an open-source distributed storage platform providing object, block, and file storage. The Monitor subscription handler in versions prior to 20.2.4 and 19.2.6 fails to authorize access to the configuration-key store. Any CephX user with only mon allow r capabilities can read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key cephadm uses to reach every host. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster compromise. This issue is classified as an improper authorization flaw [CWE-285].
Critical Impact
A read-only CephX account can retrieve OSD encryption passphrases and the cephadm SSH private key, enabling root access to every host in the cluster.
Affected Products
- Ceph versions prior to 19.2.6 (Squid release stream)
- Ceph versions prior to 20.2.4 (Tentacle release stream)
- Cephadm-managed clusters using the default SSH configuration
Discovery Timeline
- 2026-08-28 - CVE-2026-50152 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-50152
Vulnerability Analysis
The flaw resides in the Ceph Monitor subscription handler in src/mon/Monitor.cc. When a client sends an MMonSubscribe message, the Monitor iterates over the requested subscription keys and pushes updates to the client. Prior to the fix, the handler treated all subscription keys as requiring no additional capability check beyond authentication. This included kv: prefixed keys that map directly to entries in the configuration-key store.
An attacker holding only the minimal mon allow r capability can subscribe to kv: keys and receive the full contents of the config-key store. The store contains OSD LUKS passphrases and, on cephadm deployments, the mgr/cephadm/ssh_identity_key value. That SSH private key authorizes root logins to every host managed by cephadm, converting a low-privileged storage account into full-cluster and host compromise.
Root Cause
The subscription dispatch loop lacked capability enforcement for sensitive subscription types. Only monmap and config keys were treated as no-cap entries, but the code did not gate kv:, mdsmap, fsmap, osdmap, or osd_pg_creates behind their respective capability checks.
Attack Vector
The attack requires network access to a Monitor daemon and any CephX identity with mon allow r. The attacker crafts a single MMonSubscribe message referencing kv: prefixed keys. The Monitor responds with the corresponding config-key store contents. No user interaction is required and the scope changes because the leaked SSH key enables privileged operations on hosts outside the storage subsystem.
// Patched dispatch in src/mon/Monitor.cc adds capability gating per subscription type
if (p->first == "monmap" || p->first == "config") {
// these require no caps
+ } else if (p->first.starts_with("mdsmap") || p->first.starts_with("fsmap")) {
+ if (!s->is_capable("mds", MON_CAP_R)) {
+ dout(5) << __func__ << " " << op->get_req()->get_source_inst()
+ << " not enough caps for " << p->first << " -- dropping"
+ << dendl;
+ continue;
+ }
+ } else if (p->first == "osdmap") {
+ if (!s->is_capable("osd", MON_CAP_R)) {
+ continue;
+ }
+ } else if (p->first == "osd_pg_creates") {
+ if (!s->is_capable("osd", MON_CAP_W)) {
+ continue;
+ }
+ } else if (p->first.starts_with("kv:")) {
+ if (!s->is_capable("config-key", MON_CAP_R)) {
+ continue;
+ }
Source: GitHub Ceph Commit d971bb2 and GitHub Ceph Commit f2840d2. The patches introduce is_capable checks for mds, osd, and config-key scopes before dispatching subscription updates.
Detection Methods for CVE-2026-50152
Indicators of Compromise
- Monitor debug logs showing MMonSubscribe messages from CephX identities whose capabilities do not include mon allow r config-key yet receive kv: updates.
- Unexpected cephadm SSH sessions to cluster hosts originating from IP addresses outside the management plane.
- New or modified authorized_keys entries on cephadm-managed hosts that do not match the operator inventory.
Detection Strategies
- Audit CephX user capability grants and flag any account with mon allow r that also has network reachability to Monitor daemons on TCP 3300 or 6789.
- Enable Monitor debug logging at level 5 for the subsystem and correlate MMonSubscribe events against the requesting entity's capability set.
- Compare current cluster versions against fixed releases 19.2.6 and 20.2.4 across all Monitor nodes.
Monitoring Recommendations
- Forward Monitor and cephadm logs into a centralized analytics pipeline for capability-mismatch detection and long-term retention.
- Alert on any read of mgr/cephadm/ssh_identity_key or OSD LUKS passphrase keys from the config-key store.
- Monitor for anomalous SSH authentication events on cluster hosts, specifically root logins keyed to the cephadm identity.
How to Mitigate CVE-2026-50152
Immediate Actions Required
- Upgrade all Monitor daemons to Ceph 19.2.6 (Squid) or 20.2.4 (Tentacle) before returning them to service.
- Rotate the cephadm SSH identity key and redeploy the public key to every managed host after patching.
- Rotate OSD LUKS passphrases stored in the config-key store and audit any account that previously held mon allow r.
- Review CephX user capabilities and revoke mon allow r from any identity that does not require broad Monitor read access.
Patch Information
The vendor fix is available in Ceph 19.2.6 and 20.2.4. The patches add capability enforcement to the Monitor subscription handler, requiring config-key read capability for kv: subscriptions, mds read for mdsmap/fsmap, osd read for osdmap, and osd write for osd_pg_creates. See GitHub Security Advisory GHSA-rg9p-5xcp-wm8h for advisory details.
Workarounds
- Restrict Monitor daemon network exposure to trusted management networks only, blocking untrusted clients at the firewall.
- Remove mon allow r from CephX identities that do not require it and issue narrowly scoped capabilities instead.
- Move sensitive material out of the config-key store where feasible, and treat the cephadm SSH key as a rotate-on-patch secret.
# Verify Monitor version and audit capabilities across all CephX users
ceph version
ceph tell mon.* version
ceph auth ls | grep -E "caps|client\."
# Revoke overly broad Monitor read capability from a specific user
ceph auth caps client.example mon 'allow r pool=data' osd 'allow rw pool=data'
# Rotate the cephadm SSH identity key after patching
ceph cephadm generate-key
ceph cephadm get-pub-key > /tmp/cephadm.pub
# Distribute /tmp/cephadm.pub to each host's authorized_keys and remove the old key
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
