Ceph up to 19.2.5/20.2.3 Monitor Subscription improper authorization

Summaryinfo

A vulnerability was found in Ceph up to 19.2.5/20.2.3. It has been declared as very critical. This impacts an unknown function of the component Monitor Subscription Handler. Such manipulation leads to improper authorization. This vulnerability is documented as CVE-2026-50152. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Ceph up to 19.2.5/20.2.3. Affected by this issue is some unknown processing of the component Monitor Subscription Handler. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-50152 since 06/03/2026. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/28/2026). The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 19.2.6 or 20.2.4 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Ceph

Version

• 19.2.0
• 19.2.1
• 19.2.2
• 19.2.3
• 19.2.4
• 19.2.5
• 20.2.0
• 20.2.1
• 20.2.2
• 20.2.3

Website

• Product: https://github.com/ceph/ceph/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion