CVE-2026-50152: Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only mon allow r capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.2.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.2.6
Event History
Frequently Asked Questions
Which Ceph deployments face the greatest impact?
Cephadm-managed clusters are especially exposed because the config-key store may contain the cephadm SSH private key. Under the default cephadm configuration, that key grants root access to every cluster host.
What access does an attacker need to exploit this issue?
An attacker needs valid CephX credentials for any user granted only `mon allow r` capabilities. They can send a single crafted MMonSubscribe message to read the entire configuration-key store; no additional privileges or user interaction are required.
Are read-only CephX users sufficient to compromise a cluster?
Yes. A read-only user can retrieve sensitive config-key entries, including OSD LUKS disk-encryption passphrases and potentially the cephadm SSH private key. In default cephadm deployments, obtaining that SSH key can lead to root access across all cluster nodes.
Which versions contain the fix?
The issue is fixed in Ceph versions 20.2.4 and 19.2.6. Versions earlier than those releases are affected.