Advisory · CVE-2026-109411
Access control bypass in Samba experimental Ceph RGW module
An authenticated user can read or overwrite restricted files on shares using the experimental vfs_ceph_rgw module by requesting a file with mismatched casing. Rated 8.1.
- Vendor
- Samba
- Product
- Samba
- Identifier / CWE
- CVE-2026-109411
CWE-178 - Action timing
- Immediate
Explain it like I’m five
The file check is case-sensitive but the lookup is not careful about it. Asking for a file with the wrong capital letters makes the server treat it as a new file and skip the permission check.
- 01Experimental share
The target share is configured with the experimental vfs_ceph_rgw module.
- 02Mismatched casing request
An authenticated user requests an existing file using mismatched character casing.
- 03Permission check skipped
The module fails the case-insensitive lookup, treats the operation as creating a new file, and skips standard permission checks.
- 04Restricted file accessed
The attacker reads or overwrites sensitive data owned by other users.
What happened
An access control bypass flaw was found in the openat function of Samba’s vfs_ceph_rgw module. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file and skip standard permission checks. The CVSS 3.1 score is 8.1.
The NVD record lists Samba 4.25.0 through before 4.25.1 as affected, with 4.25.1 as the fixing release. Exposure is limited to shares using the experimental module, so most Samba deployments are not affected, but any Ceph RGW-backed share should be checked.
What to do
- Inventory Samba shares configured with the vfs_ceph_rgw module.
- Upgrade Samba to 4.25.1 or later.
- Restrict access to affected shares until patched.
- Review share logs for mismatched-casing requests against restricted files.
- Confirm the deployed version after patching.
Management note
Experimental modules still carry production risk when they guard real data. This one only bites Ceph RGW shares, so the response is a targeted check, not a fleet-wide alarm.