{"id":"EUVD-2026-37990","enisaUuid":"810fc911-52e4-325b-a485-87db05b28df7","description":"Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate files in an imported remote cluster within the /var/snap/microceph confinement. This would allow daemon disruption and pollution of the cluster state.","datePublished":"Jun 19, 2026, 4:57:48 AM","dateUpdated":"Jun 22, 2026, 3:02:10 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H","references":"https://github.com/canonical/microceph/pull/758\n","aliases":"CVE-2026-10720\nGHSA-xg3j-c7q4-f9ph\n","assigner":"canonical","epss":0.3,"enisaIdProduct":[{"id":"3fac6548-b113-3b0e-99b7-fb1d94984f3f","product":{"name":"Microceph","vendor":{"name":"Canonical"}},"product_version":"19.2.1+snap74c0060321 \u003c19.2.3+snapcf306793a4"},{"id":"a63f4209-adbe-3979-9dc5-ad3912518ba2","product":{"name":"Microceph","vendor":{"name":"Canonical"}},"product_version":"20.0.0 \u003c20.2.0+snapbe4e67380e"}],"enisaIdVendor":[{"id":"af796ad9-6ccd-345b-b156-ef9418b038a6","vendor":{"name":"Canonical"}}],"enisaIdVulnerability":[{"id":"2984623c-3688-3b88-ae9f-e5d7a4bb49ef","vulnerability":{"id":"CVE-2026-10720","description":"Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate files in an imported remote cluster within the /var/snap/microceph confinement. This would allow daemon disruption and pollution of the cluster state.","datePublished":"Jun 19, 2026, 4:57:48 AM","dateUpdated":"Jun 22, 2026, 3:02:10 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H","references":"https://github.com/canonical/microceph/pull/758\n","enisa_id":"EUVD-2026-37990\n","assigner":"canonical","epss":0.3,"dataProcessed":"Nov 5, 2026, 7:15:15 AM","vulnerabilityProduct":[{"id":"6ff42684-9acf-329f-b12e-30fddf59306f","product":{"name":"Microceph","vendor":{"name":"Canonical"}},"product_version":"20.0.0 \u003c20.2.0+snapbe4e67380e"},{"id":"de6a1a0a-946d-38c6-b81e-ec05a8b30b7b","product":{"name":"Microceph","vendor":{"name":"Canonical"}},"product_version":"19.2.1+snap74c0060321 \u003c19.2.3+snapcf306793a4"}],"vulnerabilityVendor":[{"id":"a6eb14a0-a364-3212-bbfa-dc09638edeb0","vendor":{"name":"Canonical"}}]}},{"id":"c7765876-245e-32cf-9116-851190384192","vulnerability":{"id":"GHSA-xg3j-c7q4-f9ph","description":"Canonical MicroCeph: path traversal issue in the remote-import AP","datePublished":"Jun 19, 2026, 6:31:55 AM","dateUpdated":"Jul 21, 2026, 3:01:28 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-10720\nhttps://github.com/canonical/microceph/pull/758\nhttps://github.com/canonical/microceph/commit/5c2760d8fb765d670e2673d3a537b67eae4b67c6\nhttps://github.com/advisories/GHSA-xg3j-c7q4-f9ph\nhttps://github.com/canonical/microceph\n","enisa_id":"EUVD-2026-37990\n","aliases":"CVE-2026-10720\nGHSA-xg3j-c7q4-f9ph\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}