CVE-2026-109411

An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.

This vulnerability is strictly limited to Samba deployments utilizing the experimental S3-to-SMB gateway feature (vfs_ceph_rgw).

This specific feature was introduced in upstream Samba version 4.25.

Standard Red Hat Enterprise Linux (RHEL), Red Hat Ceph Storage, Red Hat In-Vehicle OS (RHIVOS), and OpenShift Container Platform packages do not include or support this experimental module. The Samba versions shipped by Red Hat predate the introduction of this feature; therefore, the vulnerable code is not present.

Clarification for Red Hat Ceph Storage Users:

Please distinguish between the standard CephFS integration and the vulnerable component:

Safe (vfs_ceph): Red Hat Ceph Storage utilizes the native vfs_ceph module for CephFS integration. This module interacts directly with libcephfs to enforce standard POSIX ACLs. It is architecturally distinct and is not related to this issue.

Vulnerable (vfs_ceph_rgw): The vulnerability exists solely in this separate, experimental vfs_ceph_rgw module (used for mapping S3 buckets to SMB) and as said above, this module is not present in Red Hat distributed Samba packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.