Gluster versions 3.12.14 and 4.1.4 included incomplete fixes for the vulnerabilities, CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930 and CVE-2018-10926. All five vulnerabilities remain exploitable via symlinks pointing to relative paths. A remote authenticated attacker could exploit one of these vulnerabilities to force a server to resolve target paths and achieve a maximum impact of arbitrary code execution.

A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GFMETALOCKKEY xattr. A remote, authenticated attacker could use this flaw to create multiple locks for single inode by using setxattr repetitively resulting in memory exhaustion of glusterfs server node.