Unauthenticated SSRF with response read-back in SeaweedFS VolumeServer (CVE-2026-73080)

SeaweedFS VolumeServer exposes an unauthenticated gRPC RPC, FetchAndWriteNeedle, that accepts a caller-supplied remote endpoint and returns the response without validating the target or requiring credentials. An unauthenticated attacker able to reach the gRPC port can coerce the server into issuing requests to arbitrary hosts - including loopback, RFC 1918, link-local, and cloud metadata endpoints such as 169.254.169.254 - and read the response back. On cloud deployments this can disclose instance metadata and IAM credentials and expose otherwise-unreachable internal services. Affected versions: - < 4.24 We recommend updating to: 4.24. CVSS 9.3 · our assessment: act_now Reference: https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-87fv-vqqr-m4jr Details: https://vuln.today/cve/CVE-2026-73080