5.1 Moyenne

CVE-2026-10720 Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the…

Description

Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate files in an imported remote cluster within the /var/snap/microceph confinement. This would allow daemon disruption and pollution of the cluster state.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Microceph 20.0	20.0.0 → < 20.2.0+snapbe4e67380e	20.2.0+snapbe4e67380e
Microceph 19.2	19.2.1+snap74c0060321 → < 19.2.3+snapcf306793a4	19.2.3+snapcf306793a4

Références

github.com github.com

Chronologie

Publiée 19 juin 2026
Dernière modification 22 juin 2026

Suivre cette CVE