Missing authorization vulnerability in the MON subscription handler of Ceph distributed storage. The flaw allows any CephX user with mon allow r capabilities to read the entire MON config-key store by sending a single crafted MMonSubscribe message. This exposes OSD LUKS passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to access every host, yielding root access under the default cephadm configuration. The attacker must have access to the Ceph cluster network and a compromised account with mon allow r permissions. No user interaction is required.