Cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asambasamba/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 20:39:14 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSamba: Access control bypass in vfs_ceph_rgw module (CVE-2026-109411)https://feed.craftedsignal.io/briefs/2026-10-samba-vfs-ceph-rgw-bypass/Wed, 28 Oct 2026 20:39:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-samba-vfs-ceph-rgw-bypass/An access control bypass vulnerability in the Samba vfs_ceph_rgw module allows an authenticated attacker to read or overwrite restricted files via case-mismatched file lookups.CVE-2026-109411 is an access control bypass vulnerability located in the openat() function of Samba's experimental vfs_ceph_rgw module. An authenticated attacker can exploit the module's failure to correctly handle case-insensitive file lookups. By requesting an existing file with mismatched character casing, the module bypasses standard permission checks, treating the request as a new file creation. This allows the attacker to read or overwrite files that would otherwise be restricted.

Impact

Authenticated attackers with access to a share configured with the vfs_ceph_rgw module can read or overwrite sensitive files owned by other users, leading to potential data exposure or file corruption.

Recommendation

  • Audit Samba configurations to identify if the experimental vfs_ceph_rgw module is currently enabled in production environments.
  • Disable the vfs_ceph_rgw module if it is not strictly required for operations until a vendor-supplied patch is applied.
  • Monitor Samba access logs for unusual patterns of file access requests involving case-sensitive/insensitive variations for the same file path.
]]>highadvisory