CVE-2026-109411
Samba: access control bypass via vfs_ceph_rgw case-insensitive open
An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.
Fixes and workarounds
Workaround
Only shares configured with the vfs_ceph_rgw module are affected. To mitigate this vulnerability, disable the experimental `vfs_ceph_rgw` module on any configured Samba shares. Edit `/etc/samba/smb.conf` to remove `ceph_rgw` from the `vfs objects` setting under the relevant share sections, then reload the Samba service: ``` systemctl reload smb ``` Warning: Reloading or restarting the `smb` service may briefly interrupt active client sessions. Additionally, removing this module disables Ceph RGW integration for the affected shares. Setting ```case sensitive = yes``` on affected shares avoids the vulnerability, because the differently-cased name is then treated as a distinct object rather than resolving to the existing file. Note: This changes share behavior for clients that rely on case-insensitive name handling.
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Samba Samba samba
https://gitlab.com/samba-team/samba |
≥ 4.25.0; < 4.25.1 (affected, semver)
Other versions: unaffected |
CNA: redhat |
| Red Hat Enterprise Linux 10 Red Hat samba
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Enterprise Linux 6 Red Hat samba
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Enterprise Linux 6 Red Hat samba4
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Enterprise Linux 7 Red Hat samba
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Enterprise Linux 8 Red Hat samba
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Enterprise Linux 9 Red Hat samba
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4 Red Hat openshift/ose-rhel-coreos-8
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat OpenShift Container Platform 5 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 8.1 high |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | CNA: redhat |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/security/cve/CVE-2026-109411CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://attachments.samba.org/attachment.cgi?id=19294CNA: redhat
- https://attachments.samba.org/attachment.cgi?id=19295CNA: redhat
- https://bugzilla.redhat.com/show_bug.cgi?id=2552136CNA: redhat · issue-tracking, x_refsource_REDHAT
- https://bugzilla.samba.org/show_bug.cgi?id=16276CNA: redhat
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.