Database/Control plane, storage & DevOps
CephFS (ceph-fuse client): A tenant with an ordinary unprivileged UID on a node that has a CephFS volume mounted via
Impact
A tenant with an ordinary unprivileged UID on a node that has a CephFS volume mounted via ceph-fuse can chmod its way to running code as root on that node, which in turn hands it whatever CephX key the mount was made with. On a shared GPU node that means the tenant inherits the mount's view of the whole file system, not just its own subtree.
Who can reach it
Any local unprivileged user on a compute node where ceph-fuse has mounted CephFS. No cluster network access is needed and no CephX credential of the attacker's own is required.
What to do
Upgrade ceph-fuse to 17.2.8 / 18.2.5 / 19.2.3 or later on every node that fuse-mounts CephFS, then remount. Where possible prefer the kernel CephFS client for tenant nodes and scope each mount's CephX key to a single subtree so a compromised mount cannot read the rest of the tree.
References
Related entries
- PostgreSQL pgcrypto: PGP functions emit recoverable cleartext when OpenSSL disables the cipherCVE-2026-14663 · PostgreSQL pgcrypto (pgp_sym_encrypt / pgp_pub_encrypt family)Medium
- Keycloak: authenticated user can exhaust server memory via unbounded Prometheus metric labelsCVE-2026-16100 · Keycloak (user-event Prometheus metrics)Medium
- open-iscsi iscsiuio (DHCPv6 handling): Integer underflow and out-of-bounds read in iscsiuio's DHCPv6 handlingCVE-2026-18727 · open-iscsi iscsiuio (DHCPv6 handling)Medium
- Grafana: injected timeGroup macro in a SQL query exhausts memory and kills the server processCVE-2026-19475 · Grafana SQL data sources (regex macro parsing, timeGroup injected via WHERE clause)Medium
- lldpd (802.1Q VLAN tag stripping in lldpd_decode): lldpd strips 802.1Q VLAN tags by memmove-ing the frame payload fourCVE-2026-46433 · lldpd (802.1Q VLAN tag stripping in lldpd_decode)Medium
- Apache Airflow: Bulk Variables API skips key-based redaction, returning JSON variable secrets in cleartextCVE-2026-48828 · Apache Airflow (Bulk Variables API, secrets masker key-based redaction)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.