Improper authorization in Ceph Monitor subscription handler

Successful exploitation allows unauthorized disclosure of the full Ceph Monitor config-key store to a user who should not have access to it. Depending on cluster configuration, this can expose secrets such as OSD LUKS passphrases and cephadm-managed SSH credentials. In default cephadm deployments, disclosure of those credentials can enable compromise of managed hosts and potentially root-level access across the cluster environment. The vulnerability therefore has severe confidentiality impact and can also lead to follow-on integrity and privilege-escalation consequences.

Restrict access to the Ceph cluster and minimize assignment of CephX identities with monitor read capabilities until patched releases are deployed. Limit exposure of monitor endpoints to trusted administrative networks and principals only. Review CephX caps to ensure least privilege, and reduce or remove monitor read access from accounts that do not strictly require it. If compromise is suspected, rotate secrets stored in the config-key store and associated orchestration credentials.

Upgrade Ceph to a fixed release that includes the authorization correction in the Monitor subscription handler. The patched releases identified are Ceph Tentacle 20.2.4 and Ceph Squid 19.2.6, and downstream vendor updates incorporating those fixes should be applied where applicable. After patching, review whether sensitive material stored in the Monitor config-key store may have been exposed and rotate affected secrets, including cluster management credentials and encryption-related keys, as appropriate.