CVE-2020-10763: Information Disclosure in Heketi
Summary
CVE-2020-10763: Heketi logs sensitive information. Affects github.com/heketi/heketi versions < 10.1.0. Fixed in 10.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Heketi is a storage management framework designed for GlusterFS, a distributed file system. It provides a RESTful interface for provisioning, managing, and monitoring storage clusters. Heketi is written in Go and is widely used in cloud and container environments. However, versions prior to 10.1.0 suffer from an information-disclosure vulnerability that can be exploited by attackers with local access to the Heketi server.
Vulnerability Detail
The vulnerability in Heketi allows an attacker with local access to the server to read sensitive information, such as gluster-block passwords, due to improper logging practices. This information can be leveraged to gain unauthorized access to the storage clusters managed by Heketi. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Latest published version: v10.3.0+incompatible as of 23 Oct 2026
go get github.com/heketi/heketi@v10.3.0+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.1.0
This is the first release that contains the fix.
go get github.com/heketi/heketi@v10.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually modify the logging configuration of Heketi to disable the logging of sensitive information. This can be achieved by editing the Heketi configuration file and adjusting the logging settings. However, this workaround is not recommended as it may impact the overall logging functionality of Heketi.
Conclusion
In conclusion, the information-disclosure vulnerability in Heketi can be mitigated by upgrading to version 10.1.0 or later. It is crucial to address this vulnerability promptly to prevent unauthorized access to sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/heketi/heketi →
FAQ
Heketi is a storage management framework for GlusterFS, providing a RESTful interface for provisioning, managing, and monitoring storage clusters.
The vulnerability allows attackers with local access to the Heketi server to read sensitive information, potentially leading to unauthorized access to storage clusters.
To fix this vulnerability, upgrade to Heketi version 10.1.0 or later, which includes a fix for the information-disclosure flaw.
A workaround involves modifying the logging configuration of Heketi to disable the logging of sensitive information. However, this workaround is not recommended.
The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/heketi/heketi.
