Samba Access Control Bypass Exposes Restricted Files

What happened

Samba's advisory describes an access control flaw in Samba that works like a file clerk treating a familiar name as a new person simply because its capitalization changed. Under specific conditions, the server mistakes a request for an existing file for a request to create a file, leaving the existing file's permission checks out of the decision.

The issue, tracked as CVE-2026-109411, affects shares configured with the experimental vfs_ceph_rgw module. A share is a collection of files made available through the server. A signed-in user can exploit the flaw to read restricted files or overwrite their contents, including data belonging to other users. The affected version range is >= 4.25.0 and < 4.25.1; the listed fix is 4.25.1 and later.

The vendor advisory and NVD are the primary sources for this issue. NVD published its entry on 2026-10-28 and assigns a HIGH severity rating. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-29.

Technical details

This is an access control bypass: the server allows an operation that its permission rules should prevent. NVD associates the flaw with CWE-178, Improper Handling of Case Sensitivity. Case sensitivity describes whether uppercase and lowercase letters are treated as equivalent when comparing names. Here, inconsistent handling of capitalization changes how Samba processes a file request.

The root cause is in the experimental vfs_ceph_rgw module's openat() function, which handles file-opening operations. When a request names an existing file with different capitalization, the module does not correctly resolve that name through a case-insensitive lookup. It instead follows the path for creating a file and omits the normal permission checks for the file that already exists.

The attack requires an authenticated user, meaning someone who has already signed in, and a share configured with the affected module. The described result is unauthorized reading or overwriting of restricted files. Authentication therefore remains a prerequisite, but it does not reliably enforce the intended boundary between that user's access and another user's protected data in this configuration.

NVD gives CVE-2026-109411 a CVSS version 3.1 score of 8.1, rated HIGH. CVSS is a standardized system for describing vulnerability severity. The score signals a serious access-control problem, but it does not establish whether a particular server uses the module or whether exploitation has occurred. The supplied description supports unauthorized file access and modification; it does not describe additional attack capabilities.

Who is affected

Everyday users

For everyday users, the concern is the confidentiality and integrity of files stored on an affected share. Confidentiality means keeping information available only to authorized people; integrity means keeping its contents from being changed without permission. This flaw can undermine both when another signed-in user accesses a restricted file through the affected module.

The relevant fix belongs on the Samba server hosting the share. Users who do not manage that server should ask its administrator whether it runs an affected release and uses the experimental vfs_ceph_rgw module. The advisory does not establish that every Samba share is exposed, so the server's configuration matters alongside its version.

Developers

Developers responsible for software that reads or writes files on Samba shares should check the server configuration with the team that operates it. A successful sign-in does not resolve this issue: the failure occurs when the server decides whether the signed-in user may access a particular existing file. Applications that depend on that boundary could have restricted data read or overwritten.

The underlying lesson is specific to file-name handling and authorization. Name resolution determines which file an operation reaches, and permission checks must apply to that actual file. In this flaw, a capitalization mismatch sends the request into a creation path even though the target already exists. Updating the affected server addresses the identified implementation problem.

Server and IT admins

Server and IT administrators should establish both the installed Samba version and whether any shares use the experimental vfs_ceph_rgw module. The affected range is >= 4.25.0 and < 4.25.1. The described bypass depends on that module being configured, so version inventory alone does not establish whether a server meets the attack conditions.

For affected deployments, move to 4.25.1 and later by following the update steps in the vendor's advisory. Treat restricted files belonging to different users as the central permission boundary to verify afterward. The important outcome is that an existing file remains protected when a request changes the capitalization of its name.

What to do now

1. Check the installed Samba version with the version command below and compare it with the affected range, >= 4.25.0 and < 4.25.1.
2. Review the server's share configuration to establish whether the experimental vfs_ceph_rgw module is in use. Follow the vendor advisory when assessing the affected configuration.
3. Identify affected shares that hold files restricted to particular users, so the update and subsequent permission checks cover the data boundary described in the advisory.
4. Follow the update steps in the vendor's advisory to install 4.25.1 and later on affected servers.
5. After updating, confirm the installed version and validate access restrictions using controlled test files and accounts with different permissions.

smbd --version

If you can't update yet

• Check the vendor advisory for guidance on restricting access to affected shares while an update is pending.
• Check the vendor advisory for guidance on reducing internet exposure of affected services.
• Check the vendor advisory to determine whether disabling the experimental vfs_ceph_rgw module is an appropriate temporary measure for your deployment.

How to confirm the fix

• Run the version check again after the update and confirm that the installed release is 4.25.1 and later.
• Using controlled test files and authorized test accounts, confirm that a user without permission cannot read or overwrite another user's restricted file when its name is requested with different capitalization.
• Confirm that intended users can still perform their permitted file operations on the updated shares.

NVD scores and CISA KEV status

As of October 30, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

Affected products and fixed versions 1 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Samba advisory: https://www.samba.org/samba/security/CVE-2026-109411.html
• NVD: CVE-2026-109411
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 29, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.