GitHub Advisoryadvisory · Go

GHSA-xg3j-c7q4-f9ph Canonical MicroCeph: path traversal issue in the remote-import AP

MEDIUM Published 2026-06-19 Modified 2026-07-21 Official page ↗
Aliases
CVE-2026-10720
Ecosystem
Go
Packages
github.com/canonical/microceph/microceph
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H
Weaknesses
CWE-23
Reviewed
2026-06-19

Affected packages

• Go github.com/canonical/microceph/microceph: < 0.0.0-20260609072127-5c2760d8fb76 → fixed in 0.0.0-20260609072127-5c2760d8fb76

Description

Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate files in an imported remote cluster within the /var/snap/microceph confinement. This would allow daemon disruption and pollution of the cluster state.

Related

Alias · CVE (1)

  • CVE-2026-10720 Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. vulnerability

Weakness · CWE (1)

  • CWE-23 Relative Path Traversal weakness

References