SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control
Priority MEDIUM 50CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.
Summary
SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey, PutPolicy, and related IAM RPCs to mint credentials and gain S3 administrative control. This issue is fixed in versions 4.24.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00779 56th percentileScored 2026-11-07
Fix Fixed seaweedfs (seaweedfs): 4.24github.com/seaweedfs/seaweedfs (Go): 0.0.0-20260512171108-5e8f99f40a8a
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| seaweedfs | seaweedfs | before 4.24 | 4.24 | Patch available | CNA |
| — | github.com/seaweedfs/seaweedfs (Go) | before 0.0.0-20260512171108-5e8f99f40a8a | 0.0.0-20260512171108-5e8f99f40a8a | Patch available | GHSA-2v6v-25fm-p4fg |
- seaweedfs Vendorseaweedfs Affected before 4.24 Fixed in 4.24 Patch available CNA
- github.com/seaweedfs/seaweedfs (Go) Vendor— Affected before 0.0.0-20260512171108-5e8f99f40a8a Fixed in 0.0.0-20260512171108-5e8f99f40a8a Patch available GHSA-2v6v-25fm-p4fg
Remediation
- Fix · CNA seaweedfs (seaweedfs) Fixed in 4.24
- Fix · GHSA-2v6v-25fm-p4fg github.com/seaweedfs/seaweedfs (Go) Fixed in 0.0.0-20260512171108-5e8f99f40a8a Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-72920
- 2026-10-03 Alias added: GHSA-2v6v-25fm-p4fg
References
Other 5
- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-2v6v-25fm-p4fg
- https://github.com/seaweedfs/seaweedfs/pull/9442
- https://github.com/seaweedfs/seaweedfs/commit/5e8f99f40a8abc7b449aefd260516443377041c7
- https://github.com/seaweedfs/seaweedfs/releases/tag/4.24
- https://github.com/seaweedfs/seaweedfs
More seaweedfs vulnerabilities
- TI-2026-39686 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access CVSS 4.0HIGH 7.8
- TI-2026-53965 SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite CVSS 3.1HIGH 8.1
- TI-2024-26879 seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component… CVSS 3.1MEDIUM 6.5
- TI-2026-42003 SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys CVSS 4.0HIGH 7.2
- TI-2026-74336 Hard-coded SSH host key in SeaweedFS SFTP Helm chart CVSS 4.0HIGH 7.0
- TI-2026-54097 Incorrect authorization in seaweedfs CVSS 3.1HIGH 7.1
Sources
- CVE-2026-72920 · CVE Program
- CVE-2026-72920 · NVD
- FIRST EPSS
- GHSA-2v6v-25fm-p4fg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences