DEBIAN-CVE-2026-109411: High severity debian/samba vulnerability

Q: Which deployments are exposed?

The issue affects Samba shares configured to use the experimental vfs_ceph_rgw module. The provided information does not indicate that shares without this module are affected.

Q: What does an attacker need to exploit this issue?

An attacker needs to be an authenticated user with access to an affected share. They must request an existing file using character casing that differs from the file's existing name.

Q: What could indicate attempted or successful exploitation?

Look for authenticated clients accessing or overwriting existing files through names with mismatched character casing. The impact is unauthorized reading or modification of sensitive files owned by other users.

Published Oct 28, 2026

Updated

An access control bypass flaw was identified in Samba's vfscephrgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfscephrgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.

Affected Software

1 affected componentFixes available

debian/samba<2:4.25.1+dfsg-1

2:4.25.1+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/samba to a version that resolves this vulnerability.
Fixed in 2:4.25.1+dfsg-1

Event History

Oct 28, 2026

CVE Published

via OSV·08:17 PM

Data Sourced

via OSV·08:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

The issue affects Samba shares configured to use the experimental vfs_ceph_rgw module. The provided information does not indicate that shares without this module are affected.

What does an attacker need to exploit this issue?

An attacker needs to be an authenticated user with access to an affected share. They must request an existing file using character casing that differs from the file's existing name.

What could indicate attempted or successful exploitation?

Look for authenticated clients accessing or overwriting existing files through names with mismatched character casing. The impact is unauthorized reading or modification of sensitive files owned by other users.

DEBIAN-CVE-2026-109411: High severity debian/samba vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What could indicate attempted or successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What could indicate attempted or successful exploitation?