Samba vfs_ceph_rgw 模組存取控制繞過漏洞 (CVE-2026-109411)
CVE-2026-109411 - Samba: access control bypass via vfs_ceph_rgw case-insensitive open
Samba vfs_ceph_rgw 模組因大小寫處理失誤，已曝出可繞過存取控制的 CVE-2026-109411 漏洞。
- 漏洞概述：Samba vfs_ceph_rgw 模組的 openat() 函式允許已驗證使用者透過大小寫不一致的檔案請求，繞過存取控制，讀取或覆寫受限檔案。
此漏洞允許認證使用者繞過存取控制，可能導致機密資料外洩，建議即時升級或停用 vfs_ceph_rgw 模組以降低風險，並確保檔案查詢使用正確大小寫。
An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.
Impact
Affected Products
The following products are affected by CVE-2026-109411
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
| ID | Vendor | Product | Action |
|---|---|---|---|
| 1 | Redhat | enterprise_linux | |
| 2 | Redhat | openshift_container_platform | |
| 3 | Redhat | enterprise_linux | |
| 1 | Samba | samba |
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 53f830b8-0a3f-465b-8143-3b8a9948e749 | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Update Samba to fix an access control bypass vulnerability in the vfs_ceph_rgw module.
- Update Samba to the latest version.
- Disable the vfs_ceph_rgw module if not needed.
- Ensure proper case sensitivity in file lookups.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-109411 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.