CVE-2026-109411

Name	CVE-2026-109411
Description	An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
samba (PTS)	bookworm, bookworm (security)	2:4.17.12+dfsg-0+deb12u4	fixed
	trixie	2:4.22.11+dfsg-0+deb13u1	fixed
	trixie (security)	2:4.22.10+dfsg-0+deb13u2	fixed
	forky, sid	2:4.25.1+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
samba	source	bookworm	(not affected)
samba	source	trixie	(not affected)
samba	source	(unstable)	2:4.25.1+dfsg-1

Notes

[trixie] - samba <not-affected> (Vulnerable code not present)
[bookworm] - samba <not-affected> (Vulnerable code not present)
https://bugzilla.samba.org/show_bug.cgi?id=16276