Live › vulnerability › CVE-2026-109411
Go to dashboardSamba's experimental vfs_ceph_rgw module mishandles file lookups when the client uses different letter casing, so the server treats an existing file as a new one and skips its permission checks. An authenticated user can read or overwrite files owned by other users on affected shares.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 20:35 UTC. All times on this page are UTC.
Only servers that export a Samba share using the experimental vfs_ceph_rgw module, which sits on top of Ceph RADOS Gateway storage, are exposed. An attacker needs a valid account on that share. Systems using other VFS modules or plain filesystem shares are not described as affected.
No product ranges from the sources yet.
testparm -s | grep -i vfs_ceph_rgw or by searching smb.conf for vfs objects containing ceph_rgw.smbd --version; the sources do not list the fixed versions.ceph_rgw from vfs objects on affected shares or stop using the module until a patched Samba release is installed.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.
This page as .md · .json · in your agent: get_signal("CVE-2026-109411")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.