Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-50152, describes an improper authorization issue in the Ceph Monitor's subscription handler, allowing low-privileged users to read sensitive data from the config-key store. Analysis of the provided GitHub commits (d971bb2b6199f70b1708a20a63fa944ee7a94727 and f2840d2fd338ab5de2865f0f78684bbf7b888c84) reveals that both commits apply the same fix to src/mon/Monitor.cc. The core of the fix is the addition of a capability check within the Monitor::handle_subscribe function. Prior to this patch, when a client requested a subscription for an item starting with 'kv:', the system would proceed to process the subscription via kvmon()->check_sub() without verifying if the client possessed the necessary config-key read capabilities. This oversight allowed unauthorized access to the config-key store. The Monitor::handle_subscribe function is therefore the vulnerable component, as it directly handles the subscription requests and, in the vulnerable version, failed to enforce the required authorization for 'kv:' subscriptions. The added test cases in src/test/mon/test-mon-msg.cc further confirm this by demonstrating the bypass before the fix and the correct behavior after the fix.
Monitor::handle_subscribesrc/mon/Monitor.cc