CVE-2026-109411

Samba: access control bypass via vfs_ceph_rgw case-insensitive open

Published Oct 28, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.

Analysis

Technical impact

The vulnerability resides in Samba’s vfs_ceph_rgw module, specifically the openat() function. When an authenticated user requests a file whose name differs only in character case from an existing file, the module incorrectly treats the request as a creation of a new file. This misclassification bypasses the standard permission checks that would normally protect the existing file, allowing the attacker to read or overwrite files owned by other users. The issue is classified as a case sensitivity bug (CWE‑178) and enables an access‑control bypass.

Affected Systems

The flaw affects any Samba installation that enables the experimental vfs_ceph_rgw module. This includes the Red Hat Enterprise Linux family (RHEL 6 through RHEL 10) and Red Hat OpenShift Container Platform 4 when they run Samba with this module on shared resources. All shares configured with the module are susceptible; Red Hat products that install Samba with vfs_ceph_rgw fall into this bracket.

Risk and Exploitability

The CVSS base score is 8.1, indicating high severity, but the EPSS is below 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation has not been observed in the wild. Attack requires an authenticated Samba user who can request a file name with altered casing; the malformed request causes the server to skip the usual access checks. The module is experimental, which mitigates the likelihood of widespread exploitation, yet the potential for sensitive data disclosure or modification warrants prompt remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Samba

unaffected

Version	Status	Constraints
`4.25.0`	affected	< 4.25.1

Red Hat Red Hat Enterprise Linux 10 unaffected —

Red Hat Red Hat Enterprise Linux 6 unaffected —

Red Hat Red Hat Enterprise Linux 7 unaffected —

Red Hat Red Hat Enterprise Linux 8 unaffected —

Red Hat Red Hat Enterprise Linux 9 unaffected —

Red Hat Red Hat OpenShift Container Platform 4 unaffected —

Red Hat Red Hat OpenShift Container Platform 5 unaffected —

No data.

Vendor Product Versions

Samba

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

Vendor Workaround

Only shares configured with the vfs_ceph_rgw module are affected. To mitigate this vulnerability, disable the experimental `vfs_ceph_rgw` module on any configured Samba shares. Edit `/etc/samba/smb.conf` to remove `ceph_rgw` from the `vfs objects` setting under the relevant share sections, then reload the Samba service: ``` systemctl reload smb ``` Warning: Reloading or restarting the `smb` service may briefly interrupt active client sessions. Additionally, removing this module disables Ceph RGW integration for the affected shares. Setting ```case sensitive = yes``` on affected shares avoids the vulnerability, because the differently-cased name is then treated as a distinct object rather than resolving to the existing file. Note: This changes share behavior for clients that rely on case-insensitive name handling.

OpenCVE Recommended Actions

Disable the experimental vfs_ceph_rgw module by removing it from the vfs objects setting in smb.conf or by setting case_sensitive = yes to prevent the bypass.
If a patch is not immediately available, disable the vfs_ceph_rgw module by removing it from the vfs objects setting in smb.conf or set the share option case_sensitive = yes to prevent the case‑mismatch bypass.
Verify that no shares remain with the experimental module enabled and review file permissions and ACLs on critical files to limit potential impact.

Generated by OpenCVE AI on October 29, 2026 at 18:58 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.649% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-109411
https://attachments.samba.org/attachment.cgi?id=19294
https://attachments.samba.org/attachment.cgi?id=19295
https://bugzilla.redhat.com/show_bug.cgi?id=2552136
https://bugzilla.samba.org/show_bug.cgi?id=16276
https://nvd.nist.gov/vuln/detail/CVE-2026-109411
https://www.cve.org/CVERecord?id=CVE-2026-109411

History

Nov 4, 2026 10:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat rhel Els
CPEs	cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9	cpe:/a:redhat:enterprise_linux:10 cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:rhel_els:6 cpe:/o:redhat:rhel_els:7
Vendors & Products		Redhat rhel Els

Oct 30, 2026 5:15 AM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:openshift:5

Oct 29, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 29, 2026 4:45 PM Description updated View changes

Type	Values Removed	Values Added
Description	An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.	An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.

Oct 28, 2026 7:30 PM Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Title	samba: Access control bypass via vfs_ceph_rgw case-insensitive open	Samba: access control bypass via vfs_ceph_rgw case-insensitive open
First Time appeared		Redhat Redhat enterprise Linux Redhat openshift
CPEs		cpe:/a:redhat:openshift:4 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux Redhat openshift
References		https://access.redhat.com/security/cve/CVE-2026-109411 https://bugzilla.redhat.com/show_bug.cgi?id=2552136

Oct 26, 2026 3:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Samba Samba samba
Vendors & Products		Samba Samba samba

Oct 26, 2026 12:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.
Title		samba: Access control bypass via vfs_ceph_rgw case-insensitive open
Weaknesses		CWE-178
References		https://attachments.samba.org/attachment.cgi?id=19294 https://attachments.samba.org/attachment.cgi?id=19295 https://bugzilla.samba.org/show_bug.cgi?id=16276 https://nvd.nist.gov/vuln/detail/CVE-2026-109411 https://www.cve.org/CVERecord?id=CVE-2026-109411
Metrics	threat_severity `None`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}` threat_severity `Important`