Missing authentication on IAM gRPC service in SeaweedFS (CVE-2026-72920)

SeaweedFS filer registers the SeaweedIdentityAccessManagement gRPC service without authentication when jwt.filer_signing.key is unset, exposing IAM RPCs (CreateUser, CreateAccessKey, PutPolicy, and related calls) to any unauthenticated client that can reach the filer gRPC port. An attacker exploiting this flaw can mint arbitrary credentials and gain full S3 administrative control, fully compromising the confidentiality, integrity, and availability of stored objects. Affected versions: - < 4.24 We recommend updating to: 4.24. CVSS 9.8 · our assessment: act_now Reference: https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-2v6v-25fm-p4fg Details: https://vuln.today/cve/CVE-2026-72920