GlusterFS (glusterd, auth.allow): The auth.allow option does not actually restrict who may connect, so any

Impact

The auth.allow option does not actually restrict who may connect, so any unauthenticated gluster client on any network mounts the volume. Every dataset and checkpoint on that volume is readable and writable by anyone who can reach the bricks.

Who can reach it

Any host with network reach to glusterd/brick ports. No credential and no membership in the trusted pool required.

What to do

Upgrade glusterfs server to 3.10.12 / 4.0.2 or later and restart glusterd and the brick processes. Do not rely on auth.allow as the boundary - enforce TLS with client certificates (transport.socket.ssl) and firewall brick ports to known client subnets.

References