Cloudanix VulnDB

CVE-2026-109411

High · 8.1

CVSS

8.1

EPSS

0.6%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A configuration option in the Samba file server can let logged-in users reach or change files they should not be allowed to touch.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
Network Service
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vfs_ceph_rgw openat() implementation performs an incorrect case-sensitive check on incoming requests; when a client supplies an existing filename using mismatched casing, the module treats the operation as a new file creation, bypassing all subsequent permission and ownership validation for the real target object.

Why it matters to the business

Attackers with a valid account on an affected share can read or modify files belonging to other users, resulting in exposure or corruption of sensitive business data stored on Ceph-backed Samba shares.

How an attack unfolds

An authenticated client connects to a share using the experimental vfs_ceph_rgw module and issues an open or create request for an existing file while deliberately altering the case of one or more path components. The module fails to resolve the name correctly, skips ACL and ownership checks, and grants the caller read or write access to the underlying object.

How to fix it

Disable the experimental vfs_ceph_rgw module in smb.conf for any production shares until a corrected Samba build is released; monitor vendor advisories for the availability of fixed packages and apply them immediately upon release.

How to confirm the fix worked

Inspect smb.conf for any share definitions that reference vfs_ceph_rgw; after applying updates, confirm the module is no longer loaded and re-test case-variant access requests to verify permission enforcement is restored.

Typical attack path

  1. Obtain valid domain or local credentials for the Samba share
  2. Mount or connect to a share configured with vfs_ceph_rgw
  3. Issue SMB open/create operations using filenames with deliberately mismatched character casing
  4. Read or overwrite the target file contents without triggering standard access-control enforcement

How to detect it

Review Samba audit and debug logs for open or create operations on vfs_ceph_rgw shares that contain path components whose case does not match the on-disk name; correlate with subsequent unexpected file reads or writes by the same session.

What your security team should do

  • Immediately audit all Samba configurations and remove or comment out vfs_ceph_rgw from any share that serves production data
  • Place the affected systems on an expedited patching track once fixed Samba packages become available
  • Enable verbose SMB logging on shares using the module and forward logs to a SIEM for anomaly detection until remediation is complete

The record

An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities