EUVD-2026-37990
GHSA-xg3j-c7q4-f9ph
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H because exploitation requires a trusted mTLS cert or join token; S:C and I:H/A:H because cluster-wide state and daemons beyond the local node are impacted.
Primary rating from Vendor (canonical).
CVSS VectorVendor: canonical
Lifecycle Timeline
3DescriptionCVE.org
Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate files in an imported remote cluster within the /var/snap/microceph confinement. This would allow daemon disruption and pollution of the cluster state.
AnalysisAI
Path traversal in MicroCeph's remote-import API allows enrolled cluster members or join token holders to manipulate files within the /var/snap/microceph snap confinement boundary, enabling daemon disruption and cluster state pollution across the squid and tentacle release tracks. The root cause is missing input validation on name and LocalName parameters in cmdRemotePut, permitting .. sequences to reach unintended directories. No public exploit has been identified at time of analysis; an upstream fix exists as GitHub PR #758 with no confirmed tagged snap release.
Technical ContextAI
MicroCeph is Canonical's snap-packaged deployment of Ceph, a distributed storage system. The vulnerable code is in microceph/api/remote.go, specifically the cmdRemotePut handler for the remote-import API endpoint. CWE-23 (Relative Path Traversal) applies: the name field from the URL path and the LocalName and Name fields from the JSON request body were not validated against a strict character allowlist before being used to construct filesystem paths within /var/snap/microceph. An attacker could supply values like ../state or remote/name, causing file writes or manipulations to escape intended directories. The fix in PR #758 introduces validateRemoteName() and validateRemoteImportRequest() functions that enforce a [a-z][0-9]-only character allowlist and reject reserved names (ceph, ganesha, radosgw), also adding URL percent-decoding before validation to prevent encoding bypass. The CPE cpe:2.3:a:canonical:microceph:*:*:*:*:*:*:*:* covers all versions on the squid and tentacle tracks.
RemediationAI
Upstream fix available via GitHub PR #758 (https://github.com/canonical/microceph/pull/758); a released patched snap version is not independently confirmed - monitor the Canonical MicroCeph snap store channel for an updated release. Until a patch is applied, strictly control issuance and lifecycle of cluster join tokens, rotating or revoking any tokens that are no longer actively needed, as this reduces the attacker pool. Audit which systems hold trusted cluster mTLS certificates and revoke certificates for any decommissioned or untrusted nodes. Network-level access controls (firewall rules or security groups) that restrict which hosts can reach the MicroCeph API port provide an additional layer, though this does not eliminate risk from already-enrolled members. No documented method exists to disable the remote-import API endpoint independently without impacting cluster federation functionality.
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today