EUVD-2026-56159Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Exploitation requires a valid scoped JWT (PR:L); filer is network-accessible with no additional complexity; cross-tenant read and write are both achievable with no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.
AnalysisAI
Cross-tenant authorization bypass in SeaweedFS filer JWT path authorization allows any authenticated tenant to read and write data belonging to sibling tenants whose path names share a string prefix. Versions prior to 4.24 are affected: a scoped JWT issued for /tenant1 inadvertently passes the authorization check for /tenant1234, /tenant1-old, and any other path that begins with the same character sequence, because the check used Go's raw strings.HasPrefix rather than a path-component boundary comparison. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid SeaweedFS filer JWT token that is scoped to at least one path prefix (i.e., the attacker is an authenticated but lower-privileged tenant in the system). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 8.1 score accurately reflects the risk profile: AV:N/AC:L/PR:L/UI:N means any network-reachable holder of a low-privilege scoped JWT can exploit this with no setup friction, and C:H/I:H means both cross-tenant reads and writes are achievable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A tenant who has been issued a filer JWT scoped to /acme sends a GET request to the SeaweedFS filer API targeting /acmecorp/contracts/nda.pdf. The filer's pre-4.24 authorization check calls strings.HasPrefix("/acmecorp/contracts/nda.pdf", "/acme"), which returns true, and the response returns a competitor tenant's confidential document. … |
| Remediation | Upgrade SeaweedFS to version 4.24 or later, confirmed fixed via GitHub release tag 4.24 (https://github.com/seaweedfs/seaweedfs/releases/tag/4.24), PR #9439 (https://github.com/seaweedfs/seaweedfs/pull/9439), and commit 05ed5c9ae8a2a45101b52b61d02f170d20d587ff. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all SeaweedFS filer deployments at versions prior to 4.24 and catalog multi-tenant configurations; enable audit logging on path access if not already active. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery with response read-back in SeaweedFS distributed storage (versions prior to 4.24) lets anyon
Cross-tenant object deletion in SeaweedFS before 4.34 lets an authenticated S3 principal holding write access to just on
Authentication bypass in SeaweedFS filer before 4.24 exposes the SeaweedIdentityAccessManagement gRPC service without an
Cross-bucket read/write in SeaweedFS before 4.30 lets remote attackers escape a bucket's namespace because the S3 API ga
Unvalidated JSONP callback reflection in SeaweedFS before 4.30 enables cross-origin reads of cluster topology, volume se
seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_sto
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today