CVE-2026-109411 — Red Hat
HIGHCVE-2026-109411 is a high-severity (CVSS 8.1) CWE-178 vulnerability. No vendor fix is recorded yet; mitigation options are listed below.
An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files…
Description
An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.
Detection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Remediation status
No fixed release is recorded for CVE-2026-109411 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This vulnerability is strictly limited to Samba deployments utilizing the experimental S3-to-SMB gateway feature (vfs_ceph_rgw). This specific feature was introduced in upstream Samba version 4.25. Standard Red Hat Enterprise Linux (RHEL), Red Hat Ceph Storage, Red Hat In-Vehicle OS (RHIVOS), and OpenShift Container…
Only shares configured with the vfs_ceph_rgw module are affected. To mitigate this vulnerability, disable the experimental `vfs_ceph_rgw` module on any configured Samba shares. Edit `/etc/samba/smb.conf` to remove `ceph_rgw` from the `vfs objects` setting under the relevant share sections, then reload the Samba service: ``` systemctl reload smb ``` Warning: Reloading or restarting the `smb` service may briefly interrupt active client sessions. Additionally, removing this module disables Ceph RGW integration for the affected shares. Setting ```case sensitive = yes``` on affected shares avoids the vulnerability, because the differently-cased name is then treated as a distinct object rather…Source: Red Hat security advisory for CVE-2026-109411 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-109411 in your dependencies?
Find it across , including transitive dependencies.