A vulnerability in the rpc.mountd daemon of the nfs-utils package allows an NFSv3 client to bypass the permissions defined in the /etc/exports file during mount time. The flaw lets the client access any subdirectory or subtree of an exported directory regardless of traditional security safeguards such as file permissions, root_squash, or all_squash attributes. This leads to unauthorized read or write access to files and directories that the client should not be able to reach, effectively elevating the client's privileges on the NFS server.

Red Hat Ceph Storage 8, Red Hat Enterprise Linux 6, 7, 8, 9, and 10, as well as the Extended Update Support releases 9.4 and 9.6, and Red Hat OpenShift Container Platform versions 4.16 through 4.19 are affected.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is less than 1 percent, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote NFSv3 client that can mount an exported file system from the vulnerable server; by connecting from an untrusted or compromised machine, an attacker can gain unauthorized access to sensitive resources on the server.