Read the docs
TI-2026-51287 Aliases CVE-2026-73080GHSA-87fv-vqqr-m4jr

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

Priority MEDIUM 47CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the response into a needle. The RPC performs no authentication and no target validation, allowing anyone who can reach a volume server's gRPC port to cause requests to arbitrary hosts, including loopback, link-local, RFC 1918, and cloud metadata endpoints such as 169.254.169.254, and read the response. On cloud deployments, this can disclose instance metadata and IAM credentials and reach otherwise unexposed internal services. The volume server gRPC plane is unauthenticated by default, and configuring documented JWT signing keys does not protect this RPC. This issue is fixed in version 4.24.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00527 44th percentileScored 2026-11-07
Fix Fixed seaweedfs (seaweedfs): 4.24github.com/seaweedfs/seaweedfs (Go): 0.0.0-20260512171120-69da20bdaec9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
seaweedfsseaweedfsbefore 4.244.24Patch availableCNA
—github.com/seaweedfs/seaweedfs (Go)before 0.0.0-20260512171120-69da20bdaec90.0.0-20260512171120-69da20bdaec9Patch availableGHSA-87fv-vqqr-m4jr
  • seaweedfs Vendorseaweedfs Affected before 4.24 Fixed in 4.24 Patch available CNA
  • github.com/seaweedfs/seaweedfs (Go) Vendor— Affected before 0.0.0-20260512171120-69da20bdaec9 Fixed in 0.0.0-20260512171120-69da20bdaec9 Patch available GHSA-87fv-vqqr-m4jr

Remediation

  • Fix · CNA seaweedfs (seaweedfs) Fixed in 4.24
  • Fix · GHSA-87fv-vqqr-m4jr github.com/seaweedfs/seaweedfs (Go) Fixed in 0.0.0-20260512171120-69da20bdaec9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73080
  2. 2026-10-03 Alias added: GHSA-87fv-vqqr-m4jr

References

Other 5

  • TI-2026-39686 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access CVSS 4.0HIGH 7.8
  • TI-2026-53965 SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite CVSS 3.1HIGH 8.1
  • TI-2024-26879 seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component… CVSS 3.1MEDIUM 6.5
  • TI-2026-42003 SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys CVSS 4.0HIGH 7.2
  • TI-2026-74336 Hard-coded SSH host key in SeaweedFS SFTP Helm chart CVSS 4.0HIGH 7.0
  • TI-2026-54097 Incorrect authorization in seaweedfs CVSS 3.1HIGH 7.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences