Ceph dashboard (ceph-mgr dashboard module): An unauthenticated HTTP request with traversal sequences reads arbitrary

Impact

An unauthenticated HTTP request with traversal sequences reads arbitrary files off the manager node. On a real cluster that means pulling /etc/ceph/ceph.client.admin.keyring and taking full administrative control of all storage, so it is effectively a pre-auth path to cluster admin.

Who can reach it

Anyone who can reach the dashboard's HTTP port. Dashboards are frequently left reachable from the management or tenant VLAN, which is what makes this severe.

What to do

Upgrade ceph-mgr to 14.2.7 / 15.1.0 or later and restart the mgr. Assume the admin keyring leaked and rotate it. Bind the dashboard to a management-only interface behind authentication rather than exposing it on a shared network.

References