A flaw in the Ceph MON subscription handler allows any CephX user with the mon allow r capability to read the entire config-key store. The stored configuration contains sensitive operational secrets, such as OSD LUKS encryption passphrases and, on clusters managed by cephadm, the SSH private key used to administer each host. Access to these items can grant full root privileges on host devices and compromise encrypted data at rest, as the system lacks proper authorization checks for this operation (CWE‑862).

The vulnerability affects Ceph deployments that use the MON subscription handler, specifically any cluster where CephX users are granted the mon allow r capability. The affected product is the Ceph Monitor component within the Ceph distributed storage system; version information is not specified in the advisory.

The CVSS score of 8.2 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is internal; an attacker must possess or obtain CephX credentials that include mon allow r. Once authenticated, the attacker can send MMonSubscribe messages to an honest monitor and retrieve the full config-key store, leading to high impact. The reliance on privileged capabilities suggests that any compromise of low‑privilege CephX users can be leveraged to reach critical security secrets.