Samba: access control bypass via vfs_ceph_rgw case-insensitive open
Only Samba 4.25.0 shares configured with the experimental vfs_ceph_rgw module are affected. Fixed in Samba 4.25.1.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 4.25.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Samba, the open-source file and print sharing software, is affected when its experimental vfs_ceph_rgw module is used for shares. An authenticated user can exploit this flaw to bypass access controls and read or overwrite restricted files belonging to other users.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- samba
From 4.25.0 · fixed in 4.25.1
- samba
Version range not reported
- samba
Version range not reported
- samba4
Version range not reported
- samba
Version range not reported
- samba
Version range not reported
- samba
Version range not reported
- openshift/ose-rhel-coreos-8
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
References 5
access.redhat.com
attachments.samba.org
bugzilla.redhat.com
bugzilla.samba.org
Questions about CVE-2026-109411
What does this mean?
When a client requests an existing file using mismatched character casing, a share using the vfs_ceph_rgw module can treat the differently cased name as the existing file. An authenticated user can then read or overwrite restricted files owned by other users.Source: access.redhat.com
Am I affected, and how do I check?
Samba 4.25.0 and later builds that use the experimental vfs_ceph_rgw module on a share are affected. Check the installed version with smbd --version and look for ceph_rgw in the vfs objects setting of each share in smb.conf.Source: access.redhat.com
What should I do about it?
Upgrade Samba to 4.25.1 or later. If an upgrade is not possible, remove ceph_rgw from the vfs objects setting on affected shares, or set case sensitive = yes on those shares.Source: access.redhat.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data