Description

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-28T00:18:07.073Z",
  "pubdate": "2026-08-28T00:18:07.073Z",
  "executiveSummary": "This vulnerability is an improper authorization flaw within the Ceph Monitor subscription handler, classified as an access control bypass. It affects Ceph storage clusters in versions prior to 20.2.4 and 19.2.6.\nThe vulnerability allows a CephX user possessing only 'mon allow r' (read-only) capabilities to bypass authorization checks and access the cluster's configuration-key store.\nThe impact is severe; the configuration-key store contains highly sensitive information, including OSD LUKS disk-encryption passphrases and administrative SSH private keys used by cephadm for cluster management.\nAn attacker with low-privileged read-only access can leverage this vulnerability to gain full administrative control over the entire Ceph cluster and all underlying host nodes.\nExploitation requires the attacker to be a valid, authenticated CephX user, though no elevated privileges are necessary. By sending a specifically crafted MMonSubscribe message to the Monitor, the attacker can force the disclosure of sensitive keys that were intended to be protected by stricter access control policies.",
  "technicalDetails": "The root cause of this vulnerability lies in an authorization logic failure within the Monitor (mon) subscription handler component. In affected versions of Ceph, the handler responsible for managing subscription requests fails to correctly validate the requester's capabilities against the configuration-key store access requirements.\nSpecifically, when an authenticated CephX user with 'mon allow r' privileges interacts with the Monitor, the subscription mechanism does not enforce granular access control for configuration-key requests. Consequently, the Monitor subsystem treats the request as legitimate, granting the user visibility into keys that should be restricted to administrative roles.\nThe exploitation method involves the delivery of a crafted MMonSubscribe message. Because the subscription handler performs insufficient checks, the crafted message forces the Monitor to expose the contents of the configuration-key store to the unauthorized user. The attacker does not need to bypass network-level authentication, as they are already a known, albeit low-privileged, entity within the CephX authentication framework.\nThe attack flow follows these steps: 1) The attacker authenticates as a user with minimal 'mon allow r' privileges. 2) The attacker constructs an MMonSubscribe message targeting the configuration-key store. 3) The Ceph Monitor receives and processes this subscription request, erroneously failing to verify that the requestor lacks the necessary 'mon allow rwx' or higher administrative permissions. 4) The Monitor subsystem returns the requested data to the attacker, including sensitive secrets stored in the configuration-key store.\nThe post-exploitation impact is critical. The configuration-key store acts as a repository for essential infrastructure secrets. On cephadm-managed clusters, this includes the SSH private key used by the orchestrator to perform cluster operations. Since this key is typically configured to provide root-level access to all nodes in the cluster, its exfiltration leads to a total compromise of the storage environment and the underlying operating systems. Additionally, the exposure of OSD LUKS passphrases permits unauthorized access to encrypted data-at-rest across the storage fabric.\nThis vulnerability affects all Ceph versions prior to 20.2.4 and 19.2.6. No specialized bypass of transport-layer encryption or further network exploitation is required once the initial CephX session is established, making this a highly dangerous privilege escalation path."
}