Loading...
Skip to main content
GeekWala

CVE-2026-10720 — Vulnerability in...

MEDIUM

Canonical MicroCeph: path traversal issue in the remote-import AP

Published June 19, 2026Updated July 21, 2026Source: osv

Summary

Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate files in an imported remote cluster within the /var/snap/microceph confinement. This would allow daemon disruption and pollution of the cluster state.

Advisory Timeline

  • First published June 19, 2026 (115 days ago).
  • Last revised July 21, 2026 — 32 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update github.com/canonical/microceph/microceph to 0.0.0-20260609072127-5c2760d8fb76 or later
go get github.com/canonical/microceph/microceph@v0.0.0-20260609072127-5c2760d8fb76

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/canonical/microceph/microceph
go
All versions0.0.0-20260609072127-5c2760d8fb76

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.4 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H

References

Frequently Asked Questions

What is CVE-2026-10720?
Canonical MicroCeph: path traversal issue in the remote-import AP This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 8.4/10).
How do I check if my project is affected by CVE-2026-10720?
CVE-2026-10720 affects github.com/canonical/microceph/microceph. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-10720 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.4

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-xg3j-c7q4-f9ph
GO-2026-5755

Related CVEs

  • CVE-2026-34179
    CRITICAL

    LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin

  • CVE-2026-34177
    CRITICAL

    LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf

  • CVE-2026-34178
    CRITICAL

    LXD: Importing a crafted backup leads to project restriction bypass

  • CVE-2025-54286
    HIGH

    Canonical LXD CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI

  • CVE-2026-54765
    MEDIUM

    Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

  • CVE-2026-88011
    MEDIUM

    Traefik: ForwardAuth identity spoofing via dot-form header alias

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies