CVE-2026-50152 ceph CVE debrief

Who should care

Ceph users and administrators, especially those with low-privileged read-only accounts, should be aware of this vulnerability and take steps to mitigate it. This includes applying patches to upgrade to Ceph versions 20.2.4 or 19.2.6, restricting access to the configuration-key store, and monitoring for suspicious MMonSubscribe messages. Awareness and mitigation are crucial to prevent potential cluster and host compromise. Security teams and operators managing Ceph deployments should prioritize patching and review their current configurations and access controls. Additionally, they should monitor for any unusual activity that could indicate exploitation attempts. This vulnerability's high CVSS score of 9.1 underscores the importance of prompt action. Ceph users should also consider reviewing compensating controls for exposed systems while remediation is scheduled and verified. Tracking exceptions, retesting remediated assets, and documenting evidence are essential steps in the remediation process. Overall, a coordinated and thorough approach is necessary to address this critical vulnerability effectively. The configuration-key store's sensitivity and the potential for escalation to full cluster and host compromise necessitate immediate attention from all Ceph users and administrators. By taking proactive steps, they can protect their deployments from potential attacks. This involves not only technical measures but also ensuring that appropriate security protocols and awareness are in place. The goal is to minimize the risk of exploitation and maintain the security and integrity of Ceph deployments. Therefore, it is imperative that all affected parties take this vulnerability seriously and act promptly to secure their systems. This includes staying informed about the latest security advisories and updates from Ceph and implementing recommended security practices. By doing so, Ceph users and administrators can help prevent the exploitation of this vulnerability and protect their systems from potential harm. Furthermore, they should consider the broader implications of this vulnerability and how it fits into their overall security strategy. This includes assessing  

Technical summary

The Ceph Monitor subscription handler fails to properly authorize access to the configuration-key store. This allows any CephX user with `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The configuration-key store contains sensitive secrets, including OSD LUKS disk-encryption passphrases. On cephadm-managed clusters, it also includes the SSH private key that cephadm uses to reach every host in the cluster. This SSH key grants root access on every node under the default cephadm configuration. Consequently, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is addressed in Ceph versions 20.2.4 and 19.2.6.

Defensive priority

Ceph users should prioritize patching to prevent potential cluster and host compromise.

Recommended defensive actions

• Apply patches to upgrade to Ceph versions 20.2.4 or 19.2.6.
• Restrict access to the configuration-key store.
• Monitor for suspicious MMonSubscribe messages.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.