How severe is CVE-2018-1088?

CVE-2018-1088 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2018-1088 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 5% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-1088?

CVE-2018-1088 primarily affects Redhat Gluster Storage. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2018-1088?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2018-1088 published?

CVE-2018-1088 was published on 2018-04-18 and last updated on 2026-06-17.

CVE-2018-1088

CVE-2018-1088 is a high-severity vulnerability in Redhat Gluster Storage with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-266.

Key facts

Severity: High (CVSS 3.x base score 8.1)
CVSS v2: 6.8
EPSS exploit prediction: 5% (92nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-266
Affected product: Redhat Gluster Storage
Published: 2018-04-18
Last modified: 2026-06-17

Description

A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.

Frequently asked questions

What is CVE-2018-1088?: A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.
How severe is CVE-2018-1088?: CVE-2018-1088 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2018-1088 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 5% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-1088?: CVE-2018-1088 primarily affects Redhat Gluster Storage. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2018-1088?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2018-1088 published?: CVE-2018-1088 was published on 2018-04-18 and last updated on 2026-06-17.

References

Affected products (7)

cpe:2.3:a:redhat:gluster_storage:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

More vulnerabilities in Redhat Gluster Storage

CVE-2017-7481 — Critical (CVSS 9.8): Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker…
CVE-2021-44142 — High (CVSS 8.8): The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple…
CVE-2018-14653 — High (CVSS 8.8): The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the…
CVE-2018-10928 — High (CVSS 8.8): A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point…
CVE-2011-3045 — High (CVSS 8.8): Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google…
CVE-2020-25717 — High (CVSS 8.1): A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to…

All CVEs affecting Redhat Gluster Storage →

Other CWE-266 (Incorrect Privilege Assignment) vulnerabilities

CVE-2026-23800 — Critical (CVSS 10.0): Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue…
CVE-2025-41115 — Critical (CVSS 10.0): SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage…
CVE-2024-9479 — Critical (CVSS 10.0): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege…
CVE-2024-9478 — Critical (CVSS 10.0): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege…
CVE-2026-42368 — Critical (CVSS 9.9): A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A…
CVE-2026-32922 — Critical (CVSS 9.9): OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with…

Browse all CWE-266 (Incorrect Privilege Assignment) vulnerabilities →