CVE-2026-106040

Summary

This vulnerability allows unauthenticated attackers to delete disk replicas of objects across all tenants by exploiting missing authorization controls in the EvictDiskReplica and BatchEvictDiskReplica functions. This means attackers can permanently delete critical data without needing any authentication or privileges.

Exploitability

The exploit is relatively straightforward as attackers only need to reach the coro_rpc master port and send specific RPC requests, with no additional authentication requirements or complex preconditions needed.

Blast radius

The impact could be severe as attackers can delete disk replicas for objects across all tenants, potentially leading to permanent data loss for multiple customers in a shared infrastructure environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Restrict network access to the coro_rpc master port and implement proper authorization controls for EvictDiskReplica and BatchEvictDiskReplica endpoints.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.