CVE-2026-10720: MicroCeph path traversal issue in the remote-import API
Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate files in an imported remote cluster within the /var/snap/microceph confinement. This would allow daemon disruption and pollution of the cluster state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the MicroCeph remote-import API: block access from untrusted networks and allow the remote-import endpoint only from trusted management/control-plane IP ranges or known enrolled cluster member IPs (apply ACLs/firewall rules to isolate the remote-import API).
- Operational
Revoke and re-issue cluster credentials that could be abused by this vulnerability: revoke any existing MicroCeph join tokens and re-issue new join tokens; revoke and re-issue enrolled-cluster mTLS certificates (trusted cluster certificates) that may have been exposed.
- Operational
Audit and remediate file system and cluster-state pollution under /var/snap/microceph on imported remote clusters: inspect /var/snap/microceph for unauthorized modifications, restore affected files from known-good backups, restart MicroCeph daemons, and verify cluster state consistency; remove any unauthorized or polluted cluster-state entries.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10720?
CVE-2026-10720 has a medium severity rating of 5.1 according to its CVSS score.
How do I fix CVE-2026-10720?
To fix CVE-2026-10720, ensure that you update to the latest patched version of Canonical MicroCeph.
What is the impact of CVE-2026-10720?
CVE-2026-10720 allows attackers with a trusted cluster mTLS certificate to manipulate files in an imported remote cluster.
Which versions of Canonical MicroCeph are affected by CVE-2026-10720?
Canonical MicroCeph versions from the squid and tentacle track are affected by CVE-2026-10720.
What kind of vulnerability is CVE-2026-10720?
CVE-2026-10720 is classified as a path traversal vulnerability.