CVE-2026-50152

CVE-2026-50152 is an improper authorization flaw (CWE-285) in the Ceph Monitor's subscription handler: it fails to enforce access control on the configuration-key store, so any CephX account holding only the read-only `mon allow r` capability can dump the entire store by sending a single crafted MMonSubscribe message. An attacker with such a low-privileged account obtains every secret held in config-key, including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the cephadm SSH private key that by default grants root on every host, turning a read-only credential into full cluster and host compromise. All clusters running Ceph versions prior to 20.2.4 or 19.2.6 are affected. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS estimates roughly a 0.2% probability of exploitation within 30 days.

What to do: Upgrade Ceph clusters to version 20.2.4 or 19.2.6, which fix the flaw. Until patched, audit and restrict CephX accounts with `mon allow r` capability, revoking or tightening any granted to monitoring/telemetry integrations that do not strictly need it. After patching, consider rotating secrets stored in the config-key store — OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the cephadm SSH private key — if a low-privileged account may have been compromised.