Ceph is an open-source distributed storage platform that offers object, block, and file storage. In versions earlier than 20.2.4 and 19.2.6, the Monitor subscription handler does not enforce proper authorization for accessing the configuration‑key store. Any CephX user that has only the "mon allow r" capability can read the entire store by sending a single crafted MMonSubscribe message, exposing sensitive contents. The key store contains operational secrets such as OSD LUKS disk‑encryption passphrases and, on cephadm‑managed clusters, the SSH private key used by cephadm to reach every host. That key effectively provides root access on all nodes; therefore a low‑privilege read‑only account can leverage this flaw to achieve full cluster and host compromise. The vulnerability is mitigated in Ceph 20.2.4 and 19.2.6.

The vulnerability affects Ceph deployments that use the MON subscription handler, specifically any cluster where CephX users are granted the mon allow r capability. The affected product is the Ceph Monitor component within the Ceph distributed storage system; versions prior to 20.2.4 and 19.2.6 are vulnerable.

The CVSS score of 9.1 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is internal; an attacker must possess or obtain CephX credentials that include mon allow r. Once authenticated, the attacker can send MMonSubscribe requests to an honest monitor and retrieve the full config-key store, leading to high impact. The reliance on privileged capabilities suggests that any compromise of low‑privilege CephX users can be leveraged to reach critical security secrets.