{"id":"CVE-2026-109411","kind":"vulnerability","aliases":["CVE-2026-109411"],"related":[],"title":"Samba: case mismatch in vfs_ceph_rgw lets users overwrite restricted files","description":"An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.","summary":"Samba's experimental vfs_ceph_rgw module mishandles file lookups when the client uses different letter casing, so the server treats an existing file as a new one and skips its permission checks. An authenticated user can read or overwrite files owned by other users on affected shares.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ceph","file-shares","package","samba","self-hosted"],"not_affected_if":["default-config","no-vfs-ceph-rgw"],"how_to_check":"- Check whether the share configuration loads the module with `testparm -s | grep -i vfs_ceph_rgw` or by searching smb.conf for `vfs objects` containing `ceph_rgw`.\n- Check the installed version with `smbd --version`; the sources do not list the fixed versions.","fix":"- Remove `ceph_rgw` from `vfs objects` on affected shares or stop using the module until a patched Samba release is installed.\n- Upgrade Samba to a patched release; the fixed version is unknown from the sources.","status":"open","published_at":"2026-10-28T20:17:17+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","triaged_at":"2026-10-28T20:36:10+00:00","updated_at":"2026-10-28T20:36:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T20:36:10Z","model":"claude-haiku-5-5","output":{"fix":"- Remove `ceph_rgw` from `vfs objects` on affected shares or stop using the module until a patched Samba release is installed.\n- Upgrade Samba to a patched release; the fixed version is unknown from the sources.","reach":"network","title":"Samba: case mismatch in vfs_ceph_rgw lets users overwrite restricted files","impact":"high","summary":"Samba's experimental vfs_ceph_rgw module mishandles file lookups when the client uses different letter casing, so the server treats an existing file as a new one and skips its permission checks. An authenticated user can read or overwrite files owned by other users on affected shares.","category":"package","nicknames":[],"who_cares":["samba","self-hosted","ceph","file-shares"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated users read or overwrite other users' restricted files.","analyst_note":"Find the NVD or Samba advisory with the fixed Samba versions and confirm the exact module and casing behavior.","how_to_check":"- Check whether the share configuration loads the module with `testparm -s | grep -i vfs_ceph_rgw` or by searching smb.conf for `vfs objects` containing `ceph_rgw`.\n- Check the installed version with `smbd --version`; the sources do not list the fixed versions.","needs_analyst":true,"not_affected_if":["default-config","no-vfs-ceph-rgw"],"who_is_affected":"Only servers that export a Samba share using the experimental vfs_ceph_rgw module, which sits on top of Ceph RADOS Gateway storage, are exposed. An attacker needs a valid account on that share. Systems using other VFS modules or plain filesystem shares are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":3398,"output_tokens":634,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109411':15A,18A '-2026':14A,17A 'access':77C,100C,169C 'affect':74B 'allow':165C 'attack':167C 'authent':62B,96C 'bypass':79C,99C 'case':2A,44B,128C,136C 'case-insensit':135C 'caus':140C 'ceph':6A,19B,32B,87C,115C 'charact':127C 'check':60B,160C 'client':40B,120C 'configur':110C 'control':78C,101C 'correct':139C 'creat':148C 'cve':13A,16A 'data':173C 'differ':42B 'exist':50B,123C,163C 'experiment':30B,113C 'fail':131C 'file':12A,21B,36B,51B,68B,107C,124C,151C,164C 'file-shar':20B 'flaw':80C 'found':82C 'function':94C 'host':27B 'insensit':137C 'let':8A 'letter':43B 'lookup':37B,138C 'mishandl':35B 'mismatch':3A,126C 'modul':34B,89C,117C,130C 'new':54B,150C 'one':55B 'openat':93C 'oper':146C 'overwrit':10A,67B,105C,171C 'own':69B,174C 'packag':23B 'perform':133C 'permiss':59B,159C 'read':65B,103C 'request':121C 'restrict':11A,106C 'result':154C 'rgw':7A,33B,88C,116C 'samba':1A,24B,28B,84C 'self':26B 'self-host':25B 'sensit':172C 'server':47B,142C,156C 'share':22B,75B,109C 'skip':57B,157C 'standard':158C 'treat':48B,144C 'use':41B,125C 'user':9A,63B,72B,97C,177C 'vfs':5A,31B,86C,114C","nicknames":[],"mitigations":[],"who_affected":"Only servers that export a Samba share using the experimental vfs_ceph_rgw module, which sits on top of Ceph RADOS Gateway storage, are exposed. An attacker needs a valid account on that share. Systems using other VFS modules or plain filesystem shares are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T20:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109411","severity":null,"published_at":"2026-10-28T20:17:17+00:00","modified_at":"2026-10-28T20:17:17+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","fetched_at":"2026-10-28T20:35:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}