Skip to main content

Ceph CVE-2026-50152

CRITICAL
Improper Authorization (CWE-285)
2026-08-19
Authentication Bypass
9.1
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
vuln.today AI
9.9 CRITICAL

Network MMonSubscribe with low-priv CephX read gives AV:N/AC:L/PR:L/UI:N; leaked keys compromise separate hosts (S:C) yielding root-level C:H/I:H/A:H beyond the published I:L/A:L.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
8.2 HIGH
AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Red Hat
8.2 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
Low

Lifecycle Timeline

6
Source Code Evidence Fetched
Aug 28, 2026 - 00:38 vuln.today
Analysis Updated
Aug 28, 2026 - 00:38 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 28, 2026 - 00:22 vuln.today
cvss_changed
CVSS changed
Aug 28, 2026 - 00:22 NVD
9.1 (CRITICAL)
Analysis Generated
Aug 19, 2026 - 20:20 vuln.today
CVE Published
Aug 19, 2026 - 18:58 oss-security
HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News 4 New Linux Vulnerabilities - 1 Critical, 3 High Severity Aug 20, 2026

AnalysisAI

Improper authorization in the Ceph Monitor subscription handler lets any authenticated CephX user holding only mon allow r read the entire config-key (kv) store by sending a single crafted MMonSubscribe message, affecting Ceph releases prior to 20.2.4 (Squid) and 19.2.6 (Reef). Because that store holds OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key cephadm uses to reach every host as root, a low-privileged read-only account can escalate to full cluster and host compromise. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires a valid CephX identity with at least `mon allow r` capability and network reachability to a Ceph monitor daemon; no config-key capability and no admin/write privileges are needed - that missing authorization check is the entire bug. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine high-priority issue, not a high-CVSS-but-low-impact artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: upgrade to Ceph 20.2.4 (Squid) or 19.2.6 (Reef), whichever matches your release train, per the vendor advisory at https://docs.ceph.com/en/latest/security/CVE-2026-50152/ and the fix commits d971bb2b6199f70b1708a20a63fa944ee7a94727 and f2840d2fd338ab5de2865f0f78684bbf7b888c84. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: audit all production Ceph deployments and document version numbers; identify any read-only CephX accounts or service accounts with mon allow r permissions; review config-key content for SSH keys, LUKS passphrases, or other secrets and plan their removal or relocation. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-285 – Improper Authorization

View all
CVE-2025-29927 CRITICAL POC
9.1
CVE-2016-5676 HIGH POC
7.5
CVE-2025-66301 CRITICAL POC
9.6
CVE-2023-32707 HIGH POC
8.8
CVE-2016-3352 HIGH
8.8
CVE-2025-29659 CRITICAL POC
9.8
CVE-2022-2595 CRITICAL POC
10.0
CVE-2026-55166 CRITICAL POC
9.9

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

CVE-2026-50152 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy