CVE-2018-10861

HIGH

A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches m...

Affects 9 products across 4 vendors.

CVSS 3.08.1
EPSS3.2%
Percentile88th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-285: CWE-285
CWE-287: Improper Authentication

Software does not prove or insufficiently proves that the user is who they claim to be.

Related Attack Patterns (CAPEC)
CAPEC-5 Blue Boxing
via CWE-285
CAPEC-13 Subverting Environment Variable Values
via CWE-285
CAPEC-45 Buffer Overflow via Symbolic Links
via CWE-285
CAPEC-51 Poison Web Service Registry
via CWE-285
CAPEC-57 Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
via CWE-287
Show all 27

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2018. A high severity vulnerability affects Ceph systems (CVE-2018-10861). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2018-GLOBAL-123612-H • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-10861?
This vulnerability was disclosed in 2018. A high severity vulnerability affects Ceph systems (CVE-2018-10861). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2018-10861?
CVE-2018-10861 has CVSS 8.1 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS: 3.2%.
Is CVE-2018-10861 actively exploited?
No confirmed active exploitation of CVE-2018-10861 as of 2026-09-25.
How do I remediate CVE-2018-10861?
Priority: MEDIUM. Advisory: https://access.redhat.com/errata/RHSA-2018:2177 PSIRT: [email protected]
What systems are affected by CVE-2018-10861?
CVE-2018-10861 affects Ceph Ceph; Debian Debian Linux; Opensuse Leap; Redhat Enterprise Linux Workstation, Ceph Storage Mon, Enterprise Linux Server, Ceph Storage, Enterprise Linux Desktop, Ceph Storage Osd.
Vulnerability Details
CVE IDCVE-2018-10861
BSIDBS-2018-GLOBAL-123612-H BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Published2018-07-10
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
CWE-285Improper Authentication
SourceNVD
Official Description

A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.

Exploitation Likelihood: MINIMAL

Affected Products
VendorProductAffected Versions
Ceph Ceph 10.2.0 10.2.1 10.2.2 10.2.3 10.2.4 10.2.5
+16 more10.2.6 10.2.7 10.2.8 10.2.9 10.2.10 10.2.11 12.2.0 12.2.1 12.2.2 12.2.3 12.2.4 12.2.5 12.2.6 12.2.7 13.2.0 13.2.1
Debian Debian Linux 9.0
Opensuse Leap 15.0
Redhat Enterprise Linux Workstation 7.0
Redhat Ceph Storage Mon 2 3
Redhat Enterprise Linux Server 7.0
Redhat Ceph Storage 3
Redhat Enterprise Linux Desktop 7.0
Redhat Ceph Storage Osd 2 3
Remediation
View Vendor Advisory →

Remediation Priority: MEDIUM

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 3019 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashbabd203914196f4375529a7cdc790c1c68e91a2e07e6ad20a7b05bafbc3fe590ce864970afa0aefd1c3124f11d28c8cf04342413009b7701e6e478f101fe508d
Related CVEs affecting Ceph
CVE-2025-68285 9.8 In the Linux kernel, the following vulnerability has been resolved: libceph:... CVE-2023-53867 9.8 In the Linux kernel, the following vulnerability has been resolved: ceph: fi... CVE-2020-1716 8.8 A flaw was found in the ceph-ansible playbook where it contained hardcoded pa... CVE-2025-40362 8.8 In the Linux kernel, the following vulnerability has been resolved: ceph: fi... CVE-2024-48916 8.1 Ceph is a distributed object, block, and file storage platform. In versions 1...
View all Ceph CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →