Read the docs
TI-2026-53962 Aliases CVE-2026-77298

SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy

Priority MEDIUM 40CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federated user can assume a role they are not permitted to hold. The standard STS AssumeRoleWithWebIdentity path rejects such a token when the role's trust policy does not trust the token's federated provider, but the direct S3 bearer path validates only the token itself and then authenticates as the mapped role and evaluates that role's attached S3 permissions. As a result, a valid OIDC user whose token would be denied the role through STS can obtain the role's S3 access, including object read, write, and delete, by presenting the raw OIDC JWT directly to the S3 API. This issue is fixed in version 4.40

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00396 34th percentileScored 2026-11-07
Fix Fixed seaweedfs (seaweedfs): 4.40

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
seaweedfsseaweedfsbefore 4.404.40Patch availableCNA
  • seaweedfs Vendorseaweedfs Affected before 4.40 Fixed in 4.40 Patch available CNA

Remediation

  • Fix · CNA seaweedfs (seaweedfs) Fixed in 4.40

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77298

References

Other 2

  • TI-2026-39686 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access CVSS 4.0HIGH 7.8
  • TI-2026-53965 SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite CVSS 3.1HIGH 8.1
  • TI-2024-26879 seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component… CVSS 3.1MEDIUM 6.5
  • TI-2026-42003 SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys CVSS 4.0HIGH 7.2
  • TI-2026-74336 Hard-coded SSH host key in SeaweedFS SFTP Helm chart CVSS 4.0HIGH 7.0
  • TI-2026-54097 Incorrect authorization in seaweedfs CVSS 3.1HIGH 7.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences