# CVE-2026-50152: ceph: Ceph is an open-source distributed storage platform providing object, block, and file storage

CVE-2026-50152 is fixed in ceph on 1 platform by DEBIAN-CVE-2026-50152 (version 20.2.4+ds-1), released August 31, 2026. It is not reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/cve/CVE-2026-50152
- Priority: Urgent
- CVSS: 9.1 (critical)
- EPSS: 0.0025
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 28, 2026

## Description

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | ceph Debian 14 | 20.2.4+ds-1 | [DEBIAN-CVE-2026-50152](https://patchblox.com/security/data/fix/linux/debian-cve-2026-50152.md) | Aug 31, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.