Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6

CVE-2026-50152 is a critical authorization vulnerability in Ceph, the open-source distributed storage platform. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly enforce access controls on the configuration-key store. Any CephX user with minimal 'mon allow r' read-only capabilities can exploit this by sending a crafted MMonSubscribe message to read the entire config-key store. This store contains highly sensitive secrets including OSD LUKS disk-encryption passphrases and SSH private keys used by cephadm to manage cluster hosts. Because the SSH key grants root-level access to every node in a cephadm-managed cluster, a low-privileged attacker can escalate to full cluster and host compromise. The vulnerability is fixed in Ceph versions 20.2.4 and 19.2.6. Patches are available via two GitHub commits and a GitHub Security Advisory (GHSA-rg9p-5xcp-wm8h).