Tendrl API in Red Hat Gluster Storage does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.
Name: Filip Balák (Red Hat)
This issue has been addressed in the following products:
Red Hat Gluster Storage 3.4 for RHEL 7
Via RHSA-2018:2616 https://access.redhat.com/errata/RHSA-2018:2616