High
Security advisory
glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-1112
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:50 UTC · Revision 1
Source evidence
glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.
osv:CVE-2018-1112
Complete source record
{
"id": "4f6bb8d643e16a058697ec8c08b68bae01325abfe7e303098c12ec4bbef83f2a",
"url": "https://osv.dev/vulnerability/CVE-2018-1112",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-1112",
"summary": "glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.",
"evidence": "osv:CVE-2018-1112",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2018-1112",
"aliases": [
"CVE-2018-1112"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/gluster/glusterfs",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "c420ef1251b6958c9602e5c8a47c7b614daedf24"
},
{
"introduced": "92cc124298c068942ba049c2ccaa95b8c5b5294d"
},
{
"last_affected": "92cc124298c068942ba049c2ccaa95b8c5b5294d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gluster:glusterfs:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.10.12"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gluster:glusterfs:4.0.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.2"
},
{
"last_affected": "4.0.2"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"4.0.2",
"v4.0.2",
"v3.10.11",
"v3.10.10",
"v3.10.9",
"v3.10.8",
"v3.10.7",
"v3.10.6",
"v3.10.5",
"v3.10.4",
"v3.10.3",
"v3.10.2",
"v3.10.1",
"v3.10.0",
"v3.10.0rc1",
"v3.10.0rc0",
"v3.10.0alpha1",
"v3.11dev",
"v3.10dev",
"v3.9dev",
"v3.8dev",
"v3.7dev",
"v3.5qa2",
"v3.5.0qa1",
"v3.4.0alpha",
"v3.4.0qa8",
"v3.4.0qa7",
"v3.4.0qa6",
"v3.4.0qa5",
"v3.4.0qa4",
"v3.4.0qa3",
"v3.3.0qa39",
"v3.3.0qa38",
"v3.3.0qa37",
"v3.3.0qa36",
"v3.3.0qa35",
"v3.3.0beta3",
"v3.3.0qa34",
"v3.3.0qa33",
"v3.3.0qa32",
"v3.3.0qa31",
"v3.3.0qa30",
"v3.3.0qa29",
"v3.3.0qa28",
"v3.3.0qa27",
"v3.3.0qa26",
"v3.3.0qa24",
"v3.3.0qa23",
"v3.3.0qa22",
"v3.3.0qa21",
"v3.3.0qa20",
"v3.3.0qa19",
"v3.3.0qa18",
"v3.3.0qa17",
"v3.3.0qa16",
"v3.3.0qa15",
"v3.3.0qa14",
"v3.3.0qa13",
"v3.3.0qa12",
"v3.3.0qa11",
"v3.3.0qa10",
"v3.3beta2",
"v3.3.0qa9",
"v3.3.0qa8",
"v3.3.0qa7",
"v3.3.0qa6",
"v3.3.0qa5",
"v3.3.0qa4",
"v3.3.0qa3",
"v3.3.0qa2",
"v3.3.0qa1",
"branchpoint-3.2",
"v3.2.0",
"v3.2.0qa16",
"v3.2.0qa15",
"v3.2.0qa14",
"v3.2.0qa13",
"v3.2.0qa12",
"v3.2.0qa11",
"v3.2.0qa10",
"v3.2.0qa9",
"v3.2.0qa8",
"v3.2.0qa7",
"v3.2.0qa6",
"v3.2.0qa5",
"v3.2.0qa4",
"v3.1.3qa5",
"v3.1.3qa4",
"v3.1.3qa3",
"v3.1.3qa2",
"v3.1.3qa1",
"v3.1.2gsyncqa6",
"v3.1.2gsyncqa5",
"v3.1.2gsyncqa4",
"v3.1.2",
"v3.1.2qa4",
"v3.1.2qa3",
"v3.1.2qa2",
"v3.1.2qa1",
"v3.1.1",
"v3.1.1qa11",
"v3.1.1qa10",
"v3.1.1qa9",
"v3.1.1qa8",
"v3.1.1qa7",
"v3.1.1qa6",
"v3.1.1qa5",
"v3.1.1qa4",
"v3.1.1qa3",
"v3.1.1qa2",
"v3.1.1qa1",
"v3.1.0",
"v3.1.0qa46",
"v3.1.0qa45",
"v3.1.0qa44",
"v3.1.0qa43",
"v3.1.0qa42",
"v3.1.0qa41",
"v3.1.0qa40",
"v3.1.0qa39",
"v3.1.0qa38",
"v3.1.0qa37",
"v3.1.0qa36",
"v3.1.0qa35",
"v3.1.0qa34",
"v3.1.0qa33",
"v3.1.0qa32",
"v3.1.0qa31",
"v3.1.0qa30",
"v3.1.0beta",
"v3.1.0qa29",
"v3.1.0qa28",
"v3.1.0qa27",
"v3.1.0qa26",
"v3.1.0qa25",
"v3.1.0qa24",
"v3.1.0qa23",
"v3.1.0qa22",
"v3.1.0qa21",
"v3.1.0alpha",
"v3.1.0qa20",
"v3.1.0qa19",
"v3.1.0qa18",
"v3.1.0qa17",
"v3.1.0qa16",
"v3.1.0qa15",
"v3.1.0qa14",
"v3.1.0qa13",
"v3.1.0qa12",
"v3.1.0qa11",
"v3.1.0qa10",
"v3.1.0qa9",
"v3.1.0qa8",
"v3.1.0prealpha4",
"v3.1.0prealpha3",
"v3.1.0prealpha2",
"v3.1.0prealpha1",
"v3.1.0qa7",
"v3.1.0qa6",
"v3.1.0qa5",
"v3.1.0qa4",
"v3.1.0qa3",
"v3.1.0qa2",
"v3.0.1rc5",
"v3.0.1rc4",
"v3.0.1rc3",
"v3.0.1rc2",
"v3.0.1rc1",
"v3.0.0",
"v3.0.0pre1",
"2.0.1",
"2.0.0",
"2.0.0rc9",
"2.0.0rc8",
"2.0.0rc7",
"2.0.0rc6",
"2.0.0rc5",
"2.0.0rc3",
"2.0.0rc2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1112.json"
}
}
],
"modified": "2026-10-24T10:30:45.153381097Z",
"provider": "osv",
"references": [
"https://access.redhat.com/articles/3422521",
"https://access.redhat.com/errata/RHSA-2018:1268",
"https://access.redhat.com/errata/RHSA-2018:1269",
"https://review.gluster.org/#/c/19899/1..2",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1112"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2018-1112",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 436058,
"published_at": "2018-04-25T12:29:00.213+00:00"
}