.. _CVE-2026-50152:

CVE-2026-50152: Monitor config-key store readable by any CephX key
==================================================================

Summary
-------

CVE-2026-50152 is an improper authorization flaw in the Monitor subscription
handler. Any CephX user with ``mon allow r`` caps can read the entire Monitor
config-key store. This impacts confidentiality and integrity.

Patches are available in Tentacle 20.2.4 and Squid 19.2.6.

Background
----------

Any CephX user holding ``mon allow r`` caps can read the entire Monitor
config-key store by sending a single crafted ``MMonSubscribe`` message. The
config-key store is used to maintain various secrets used in Ceph. This
includes OSD LUKS passphrases and, on ``cephadm``-managed clusters, the SSH
private key ``cephadm`` uses to authenticate on every Ceph host.

The attacker needs access to the cluster and the CephX key of an entity with
``mon allow r`` authorization (caps). No third-party interaction is required.

Scope may change with the cluster's management configuration. The impact to
confidentiality and integrity is high.

CVSS breakdown
--------------

* **Confidentiality**: High. An attacker can exfiltrate the entire cluster secret store, including dm-crypt keys, dashboard secrets, and gateway credentials.
* **Integrity**: Low. An attacker, with a recovered ``cephadm`` SSH key, can indirectly obtain root on every host managed by ``cephadm``. Depending on the configuration, this chain of attack could include the entire Ceph cluster, destroying the integrity of the keys used within Ceph.
* **Availability**: Low. An attacker, with a recovered ``cephadm`` SSH key or a LUKS passphrase, can indirectly obtain root on every host managed by ``cephadm``. This can be used to destroy or deny access to data.
* **Access Complexity**: Low. A single ``MMonSubscribe`` message deterministically dumps the Monitor config-key store, with no additional conditions.
* **Authentication**: Yes. An attacker needs a valid CephX identity with ``mon allow r`` permissions.
* **Gained Access**: Yes. An attacker can escalate permissions from a simple ``mon allow r`` to OSD LUKS passphrases and the ``cephadm`` SSH key, granting root access.

Affected versions
-----------------

All prior versions of Ceph are vulnerable due to an improper authorization flaw
in the Monitor subscription handler.

Fixed versions
--------------

* Tentacle 20.2.4 (and later)
* Squid 19.2.6 (and later)

.. _CVE-2026-50152-recommendations:

Recommendations
---------------

All Ceph users should upgrade immediately.

Formal guidance on rotating all secrets stored in the Monitor config-key store
will be forthcoming. In the meantime, operators of cephadm-managed clusters are
strongly encouraged to rotate the cephadm SSH key. An established process is
outlined in :ref:`cephadm-ssh-configuration`.

Rotating other secrets is advised but the process is not yet established.
Operators should assess their cluster's potential exposure to determine if
immediate Monitor config-key secret rotation is required for their environment.
Additionally, follow any key migration guidance in your product-specific
documentation.

Credits
-------

This vulnerability was reported independently by David Mohren and Mark Nelson
of CLYSO. It was also reported and validated by David Korczynski of Ada Logics,
as it was found by Anthropic using agents to study the security of open-source
projects.


.. _NIST-CVE-2026-50152: https://nvd.nist.gov/vuln/detail/CVE-2026-50152