High [CVE-2026-50152] MON subscription handler exposes config-key store to low-privilege CephX users

A flaw was found in the MON subscription handler of Ceph, a distributed storage system. The handler does not properly authorize access to the config-key store when processing MMonSubscribe messages.

Any CephX user holding mon allow r capabilities can read the entire config-key store, which contains sensitive operational secrets including OSD LUKS disk encryption passphrases and, on clusters managed by cephadm, the SSH private key used to administer every host.

Exposure of these secrets can lead to full host-level root access and compromise of encrypted data at rest. The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited from the adjacent cluster network with low-privilege CephX credentials and no user interaction.

Successful exploitation allows an attacker to read the full MON config-key store, exposing OSD LUKS passphrases and cephadm SSH private keys, potentially yielding root access on all cluster hosts. The vulnerability's root cause is missing authorization checks in the MON subscription handler when serving config-key store contents.

Weakness: CWE-862. Affected Red Hat products: Red Hat Ceph Storage 4; Red Hat Ceph Storage 5; Red Hat Ceph Storage 6; Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9.

Red Hat does not currently list a fixing RHSA for this CVE.