EUVD-2026-42286
GHSA-hgpf-8634-g44c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible SigV4 API with trivial crafting (AC:L); authenticated S3 user required (PR:L); only admin metadata enumeration, no data or integrity impact (C:L/I:N/A:N).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
SeaweedFS is a distributed storage system. In versions 4.08 through 4.33, requests signed with SigV4 service s3tables are routed to the S3Tables management API where authorization collapses account-less S3 identities into the shared admin account and fails open, allowing an authenticated low-privileged S3 user to enumerate administrator-owned table bucket names and ARNs. This issue is fixed in version 4.34.
AnalysisAI
Authorization collapse in SeaweedFS 4.08-4.33 allows any authenticated low-privileged S3 user to enumerate administrator-owned S3 table bucket names and ARNs via a SigV4 routing flaw. Requests signed with service identifier 'S3Tables' are misrouted to the S3Tables management API, where the authorization logic fails open by collapsing account-less S3 identities into the shared admin account, effectively granting read access to admin-scoped metadata. No public exploit code exists and this CVE is not listed in CISA KEV, but the CVSS vector (PR:L) confirms exploitation requires only a valid low-privilege S3 credential.
Technical ContextAI
SeaweedFS is an open-source distributed storage system with an S3-compatible API layer. The S3Tables feature provides table bucket management semantics. The vulnerability arises in the SigV4 request routing logic: when the service field in a signed request is set to 's3tables', the request is dispatched to the S3Tables management API code path. Within that path, the authorization subsystem fails to correctly resolve identities that lack an explicit account association - so-called 'account-less' S3 identities - instead collapsing them into the privileged shared admin account and permitting the request to proceed. This is a textbook CWE-863 (Incorrect Authorization) failure: the system does perform an authorization check but reaches the wrong decision due to identity-resolution logic that defaults to a high-privilege fallback rather than a deny. The affected CPE covers SeaweedFS 4.08 through 4.33 as confirmed by EUVD-2026-42286.
RemediationAI
Upgrade SeaweedFS to version 4.34 or later, which contains the vendor-released patch (commit b13463880c1fa62e255c058a9228b63cc95b4b36). The release is available at https://github.com/seaweedfs/seaweedfs/releases/tag/4.34, and full advisory details are at https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-hgpf-8634-g44c. If an immediate upgrade is not feasible, restrict network-level access to the SeaweedFS S3 API to only explicitly trusted and internally managed principals, eliminating the opportunity for untrusted low-privileged users to craft malicious SigV4 requests. Note that this network restriction may impact legitimate multi-tenant or federated S3 workloads. Disabling or blocking the S3Tables feature at the application or reverse-proxy layer is another compensating control, though this also prevents legitimate S3Tables usage.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today