MicroCeph path traversal issue in the remote-import API
Priority LOW 23CWE-23Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate files in an imported remote cluster within the /var/snap/microceph confinement. This would allow daemon disruption and pollution of the cluster state.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00299 22nd percentileScored 2026-11-07
Fix Fixed Microceph (Canonical): 19.2.3+snapcf306793a4, 20.2.0+snapbe4e67380egithub.com/canonical/microceph/microceph (Go): 0.0.0-20260609072127-5c2760d8fb76
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canonical | Microceph | 19.2.1+snap74c0060321 to before 19.2.3+snapcf306793a4; 20.0.0 to before 20.2.0+snapbe4e67380e | 19.2.3+snapcf306793a4, 20.2.0+snapbe4e67380e | Patch available | CNA |
| — | github.com/canonical/microceph/microceph (Go) | before 0.0.0-20260609072127-5c2760d8fb76 | 0.0.0-20260609072127-5c2760d8fb76 | Patch available | GHSA-xg3j-c7q4-f9ph |
- Microceph VendorCanonical Affected 19.2.1+snap74c0060321 to before 19.2.3+snapcf306793a4; 20.0.0 to before 20.2.0+snapbe4e67380e Fixed in 19.2.3+snapcf306793a4, 20.2.0+snapbe4e67380e Patch available CNA
- github.com/canonical/microceph/microceph (Go) Vendor— Affected before 0.0.0-20260609072127-5c2760d8fb76 Fixed in 0.0.0-20260609072127-5c2760d8fb76 Patch available GHSA-xg3j-c7q4-f9ph
Remediation
- Fix · CNA Microceph (Canonical) Fixed in 19.2.3+snapcf306793a4, 20.2.0+snapbe4e67380e
- Fix · GHSA-xg3j-c7q4-f9ph github.com/canonical/microceph/microceph (Go) Fixed in 0.0.0-20260609072127-5c2760d8fb76 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-10720
- 2026-10-03 Alias added: GHSA-xg3j-c7q4-f9ph
References
More Canonical vulnerabilities
- TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
- TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-10720 · CVE Program
- CVE-2026-10720 · NVD
- FIRST EPSS
- GHSA-xg3j-c7q4-f9ph · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences