CephFS (via OpenStack Manila native driver): A Manila user can request access for an existing CephFS identity and get

Impact

A Manila user can request access for an existing CephFS identity and get that identity's credentials handed back, which means stealing another tenant's CephFS key. With that key the attacker mounts and reads/writes shares that belong to somebody else.

Who can reach it

Any tenant able to issue Manila share-access requests against a cluster using the native CephFS driver.

What to do

Apply the Ceph and Manila updates that scope credential creation to the requesting project, restart the manila-share and ceph-mgr volumes module, then rotate every CephFS auth ID that Manila created before the fix.

References