CVE-2018-10841

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-20 · updated 2026-06-17
Weakness: CWE-288

Description

glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.

Affected products

Debian Linux: 9.0
Red Hat glusterfs: before 4.1.8 — fixed in 4.1.8

How to fix

Upgrade to a fixed version: Red Hat glusterfs 4.1.8. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2018:1954
https://access.redhat.com/errata/RHSA-2018:1955
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10841
https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html
https://review.gluster.org/#/c/20328/
https://security.gentoo.org/glsa/201904-06
https://access.redhat.com/errata/RHSA-2018:1954
https://access.redhat.com/errata/RHSA-2018:1955
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10841
https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html
https://review.gluster.org/#/c/20328/
https://security.gentoo.org/glsa/201904-06

Get alerted when CVE-2018-10841 or the next vulnerability affects your stack