How severe is CVE-2020-10736?

CVE-2020-10736 has a CVSS 3.x base score of 8.0, rated high severity. It is exploitable over an adjacent network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2020-10736 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (47th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-10736?

CVE-2020-10736 affects Linuxfoundation Ceph. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-10736?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2020-10736 published?

CVE-2020-10736 was published on 2020-06-22 and last updated on 2026-06-17.

CVE-2020-10736

CVE-2020-10736 is a high-severity vulnerability in Linuxfoundation Ceph with a CVSS 3.x base score of 8.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-285.

Key facts

Severity: High (CVSS 3.x base score 8.0)
CVSS v2: 5.2
EPSS exploit prediction: 1% (47th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-285
Affected product: Linuxfoundation Ceph
Published: 2020-06-22
Last modified: 2026-06-17

Description

An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access, resulting in gaining access to unauthorized resources. This flaw allows an authenticated client to modify the configuration and possibly conduct further attacks.

Frequently asked questions

What is CVE-2020-10736?: An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access, resulting in gaining access to unauthorized resources. This flaw allows an authenticated client to modify the configuration and possibly conduct further attacks.
How severe is CVE-2020-10736?: CVE-2020-10736 has a CVSS 3.x base score of 8.0, rated high severity. It is exploitable over an adjacent network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2020-10736 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (47th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-10736?: CVE-2020-10736 affects Linuxfoundation Ceph. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-10736?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2020-10736 published?: CVE-2020-10736 was published on 2020-06-22 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:linuxfoundation:ceph:*:*:*:*:*:*:*:*

More vulnerabilities in Linuxfoundation Ceph

CVE-2022-0670 — Critical (CVSS 9.1): A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any…
CVE-2020-12059 — High (CVSS 7.5): An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by…
CVE-2020-1699 — High (CVSS 7.5): A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of…
CVE-2021-20288 — High (CVSS 7.2): An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles…
CVE-2020-1759 — Medium (CVSS 6.4): A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse…
CVE-2020-1760 — Medium (CVSS 5.8): A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This…

All CVEs affecting Linuxfoundation Ceph →

Other CWE-285 (Improper Authorization) vulnerabilities

CVE-2025-65041 — Critical (CVSS 10.0): Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
CVE-2023-33189 — Critical (CVSS 10.0): Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization…
CVE-2022-2595 — Critical (CVSS 10.0): Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.
CVE-2021-28799 — Critical (CVSS 10.0): An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If…
CVE-2026-34048 — Critical (CVSS 9.9): Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to…
CVE-2026-5412 — Critical (CVSS 9.9): In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated…

Browse all CWE-285 (Improper Authorization) vulnerabilities →