Access Control Bypass in Samba's VFS Module

CVE-2026-109411

What is CVE-2026-109411?

An access control bypass vulnerability exists within Samba's vfs_ceph_rgw module, specifically in its openat() function. Authenticated users can exploit this flaw to bypass access controls, enabling them to read or overwrite sensitive files on shares using the experimental vfs_ceph_rgw module. The issue arises when the client makes a request for an existing file with mismatched character casing. The module fails to execute a case-insensitive lookup, causing it to misinterpret the operation as one to create a new file. Consequently, standard permission validations are overlooked, granting unauthorized access or modification to files that belong to other users, posing a significant risk to data integrity.

References