Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal flaw in the remote-import API. An attacker who possesses a trusted cluster mTLS certificate or a join token can exploit this flaw to write to arbitrary files within the /var/snap/microceph confinement. The result is daemon disruption and pollution of the cluster state, as described by CWE-23.

The affected products are Canonical MicroCeph on the squid and tentacle tracks. No specific version numbers are supplied; the vulnerability applies to any release from those tracks that has not been patched by Canonical.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, so an exact exploitation probability cannot be stated, though the lack of an EPSS entry suggests limited public exploitation. The flaw requires authenticated access via a valid mTLS certificate or join token; the attack is therefore not remote-anonymous but can be executed by any member with sufficient credentials. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation at the time of this analysis.