OSNEXUS QuantaStor: unauthenticated Kapacitor access gives remote code execution as root on the storage node

Impact

QuantaStor ships Kapacitor configured without authentication in front of functionality that executes code, so anyone who can reach the service on the network runs commands as root on the storage appliance. QuantaStor is deployed as scale-out block and file storage - in a GPU environment that is the tier holding datasets, checkpoints, and VM images, usually reachable from the training network as well as the management VLAN. Root on the storage controller means reading or tampering with every tenant's data on that appliance, and a storage node is expensive to take offline because jobs across the fleet stall when it goes away. ZDI reports no authentication requirement at all.

Who can reach it

Anyone with network reachability to the affected QuantaStor installation's Kapacitor port. No authentication and no prior foothold required.

What to do

The record here carries only the ZDI advisory and does not name a fixed QuantaStor build - check with OSNEXUS for the patched release rather than assuming one exists. In the meantime the exposure is network-reachable-only, so firewall the Kapacitor port so it is not reachable from tenant or training networks and restrict QuantaStor management to a trusted VLAN. Applying a vendor update to a storage controller typically means a controller-side service restart or failover; plan for the array to be degraded during the window.

References