CVE-2026-109411: Samba: access control bypass via vfs_ceph_rgw case-insensitive open
[Unknown description]
Other sources
An access control bypass flaw was identified in Samba's vfscephrgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfscephrgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.
— MITRE
On shares using the vfscephrgw module, the module's openat() implementation ignored the (possibly case-corrected) filename supplied by the file server and instead re-opened the name originally sent by the client.
When a client opened an existing file using a different case than it exists on disk with a create disposition of FILEOPENIF, the case-insensitive lookup failed inside the module. The file server then treated the request as a file creation, checking only the caller's permission to add a file to the parent directory and skipping the access check on the existing object. The subsequent open then collided with, and re-opened, the existing object.
As a result an authenticated user could read or overwrite files owned by another user, despite those files having restrictive permissions.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sambato a version that resolves this vulnerability.Fixed in 2:4.17.12+dfsg-0+deb12u4Fixed in 2:4.22.11+dfsg-0+deb13u1Fixed in 2:4.22.10+dfsg-0+deb13u2Fixed in 2:4.25.1+dfsg-1 - Upgrade
Upgrade
debian/sambato a version that resolves this vulnerability.Fixed in 2:4.25.1+dfsg-1
Event History
Frequently Asked Questions
Which Samba deployments are exposed?
The issue affects shares configured with the experimental vfs_ceph_rgw module. The described bypass requires an authenticated user who can access such a share.
What does an attacker need to do to bypass the access check?
The attacker must open an existing file using a filename with casing that differs from the name on disk and use the FILE_OPEN_IF create disposition. The server can then treat the request as a new-file creation and check only whether the user may add files to the parent directory.
What access could an attacker gain?
An authenticated attacker may read or overwrite restricted existing files, including sensitive data owned by other users. The vulnerability affects confidentiality and integrity, but the provided data does not describe an availability impact.
What can be done while waiting to patch?
Restrict or disable use of the experimental vfs_ceph_rgw module on affected shares where possible. Limit write or file-creation permissions in parent directories to trusted users, since the bypass relies on permission to add a file there.