CVE-2026-109411
Description
An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.
Statement
This vulnerability is strictly limited to Samba deployments utilizing the experimental S3-to-SMB gateway feature (vfs_ceph_rgw).
This specific feature was introduced in upstream Samba version 4.25.
Standard Red Hat Enterprise Linux (RHEL), Red Hat Ceph Storage, Red Hat In-Vehicle OS (RHIVOS), and OpenShift Container Platform packages do not include or support this experimental module. The Samba versions shipped by Red Hat predate the introduction of this feature; therefore, the vulnerable code is not present.
Clarification for Red Hat Ceph Storage Users:
Please distinguish between the standard CephFS integration and the vulnerable component:
Safe (vfs_ceph): Red Hat Ceph Storage utilizes the native vfs_ceph module for CephFS integration. This module interacts directly with libcephfs to enforce standard POSIX ACLs. It is architecturally distinct and is not related to this issue.
Vulnerable (vfs_ceph_rgw): The vulnerability exists solely in this separate, experimental vfs_ceph_rgw module (used for mapping S3 buckets to SMB) and as said above, this module is not present in Red Hat distributed Samba packages.
Mitigation
Only shares configured with the vfs_ceph_rgw module are affected.
To mitigate this vulnerability, disable the experimental `vfs_ceph_rgw` module on any configured Samba shares. Edit `/etc/samba/smb.conf` to remove `ceph_rgw` from the `vfs objects` setting under the relevant share sections, then reload the Samba service:
systemctl reload smb
Warning: Reloading or restarting the `smb` service may briefly interrupt active client sessions. Additionally, removing this module disables Ceph RGW integration for the affected shares.
Setting
case sensitive = yeson affected shares avoids the vulnerability, because the differently-cased name is then treated as a distinct object rather than resolving to the existing file.
Note: This changes share behavior for clients that rely on case-insensitive name handling.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 8.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Improperly handled case sensitive data can lead to several possible consequences, including: - case-insensitive passwords reducing the size of the key space, making brute force attacks easier - bypassing filters or access controls using alternate names - multiple interpretation errors using alternate names.
Acknowledgements
Red Hat would like to thank hataehoon for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
