CVE-2026-50152: Monitor config-key store readable by any CephX key

Summary

CVE-2026-50152 is an improper authorization flaw in the Monitor subscription handler. Any CephX user with mon allow r caps can read the entire Monitor config-key store. This impacts confidentiality and integrity.

Patches are available in Tentacle 20.2.4 and Squid 19.2.6.

Background

Any CephX user holding mon allow r caps can read the entire Monitor config-key store by sending a single crafted MMonSubscribe message. The config-key store is used to maintain various secrets used in Ceph. This includes OSD LUKS passphrases and, on cephadm-managed clusters, the SSH private key cephadm uses to authenticate on every Ceph host.

The attacker needs access to the cluster and the CephX key of an entity with mon allow r authorization (caps). No third-party interaction is required.

Scope may change with the cluster’s management configuration. The impact to confidentiality and integrity is high.

CVSS breakdown

Confidentiality: High. An attacker can exfiltrate the entire cluster secret store, including dm-crypt keys, dashboard secrets, and gateway credentials.
Integrity: Low. An attacker, with a recovered cephadm SSH key, can indirectly obtain root on every host managed by cephadm. Depending on the configuration, this chain of attack could include the entire Ceph cluster, destroying the integrity of the keys used within Ceph.
Availability: Low. An attacker, with a recovered cephadm SSH key or a LUKS passphrase, can indirectly obtain root on every host managed by cephadm. This can be used to destroy or deny access to data.
Access Complexity: Low. A single MMonSubscribe message deterministically dumps the Monitor config-key store, with no additional conditions.
Authentication: Yes. An attacker needs a valid CephX identity with mon allow r permissions.
Gained Access: Yes. An attacker can escalate permissions from a simple mon allow r to OSD LUKS passphrases and the cephadm SSH key, granting root access.

Affected versions

All prior versions of Ceph are vulnerable due to an improper authorization flaw in the Monitor subscription handler.

Fixed versions

Tentacle 20.2.4 (and later)
Squid 19.2.6 (and later)

Recommendations

All Ceph users should upgrade immediately.

Formal guidance on rotating all secrets stored in the Monitor config-key store will be forthcoming. In the meantime, operators of cephadm-managed clusters are strongly encouraged to rotate the cephadm SSH key. An established process is outlined in SSH Configuration.

Rotating other secrets is advised but the process is not yet established. Operators should assess their cluster’s potential exposure to determine if immediate Monitor config-key secret rotation is required for their environment. Additionally, follow any key migration guidance in your product-specific documentation.

Credits

This vulnerability was reported independently by David Mohren and Mark Nelson of CLYSO. It was also reported and validated by David Korczynski of Ada Logics, as it was found by Anthropic using agents to study the security of open-source projects.

Brought to you by the Ceph Foundation

The Ceph Documentation is a community resource funded and hosted by the non-profit Ceph Foundation. If you would like to support this and our other efforts, please consider joining now.