Samba vfs_ceph_rgw: Access control bypass via case-mismatched file open
Summary
The experimental vfs_ceph_rgw module of Samba, which maps Ceph Object Gateway buckets to SMB shares, contains an access control bypass in its openat() function. An authenticated user who requests an existing file with different letter casing causes the server to treat the request as creating a new file, so the permission checks on the existing file are skipped. This allows reading or overwriting files owned by other users on shares that use this module. Shares without vfs_ceph_rgw are not affected.
Affected
- Samba 4.25.0 to before 4.25.1, only with the vfs_ceph_rgw module configured on a share
- Red Hat products: not affected (module not shipped)
Fixed in
- Samba 4.25.1
Workaround
- Remove ceph_rgw from the vfs objects setting of affected shares in /etc/samba/smb.conf, then run systemctl reload smb (this may briefly interrupt client sessions and disables Ceph RGW integration for those shares)
- Alternatively, set case sensitive = yes on affected shares (this changes behaviour for clients that rely on case-insensitive names)
Exploitation
- No known exploitation in the wild (CISA SSVC: exploitation none, automatable no)
- No public proof of concept found
- EPSS: 0.65 % (percentile 51)
Our recommendation
- Check whether vfs_ceph_rgw is configured in smb.conf; if not, no action is needed.
- If it is used, update to Samba 4.25.1 or later.
- Until the update is applied, apply one of the workarounds above and reload smb.
- Review access logs for case-mismatched file access to sensitive shares.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-109411 access.redhat.com
- Samba Bugzilla 16276 bugzilla.samba.org
- Samba security history www.samba.org
- Red Hat Bugzilla 2552136 bugzilla.redhat.com
- Samba 4.25.1 release coverage (samba.plus) samba.plus
- VulDB CVE-2026-109411 vuldb.com
- Samba attachment 19294 attachments.samba.org
- Samba attachment 19295 attachments.samba.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:51.
Original description (NVD)
An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.