Samba: Access control bypass in vfs_ceph_rgw module (CVE-2026-109411)

CVE-2026-109411 is an access control bypass vulnerability located in the openat() function of Samba's experimental vfs_ceph_rgw module. An authenticated attacker can exploit the module's failure to correctly handle case-insensitive file lookups. By requesting an existing file with mismatched character casing, the module bypasses standard permission checks, treating the request as a new file creation. This allows the attacker to read or overwrite files that would otherwise be restricted.

Impact

Authenticated attackers with access to a share configured with the vfs_ceph_rgw module can read or overwrite sensitive files owned by other users, leading to potential data exposure or file corruption.

Recommendation

• Audit Samba configurations to identify if the experimental vfs_ceph_rgw module is currently enabled in production environments.
• Disable the vfs_ceph_rgw module if it is not strictly required for operations until a vendor-supplied patch is applied.
• Monitor Samba access logs for unusual patterns of file access requests involving case-sensitive/insensitive variations for the same file path.