SeaweedFS CVE-2026-73080

Exploitation requires network reachability to a SeaweedFS volume server's gRPC port, which is unauthenticated by default - configuring the documented JWT signing keys does NOT protect the FetchAndWriteNeedle RPC, so JWT-hardened deployments remain exposed. The specific feature abused is the remote-storage fetch path (FetchAndWriteNeedle calling the S3 remote storage client) that accepts a caller-supplied endpoint with no target validation. Highest impact requires the volume server to run in an environment with a reachable metadata service (e.g., AWS/GCP/Azure IMDS at 169.254.169.254) or valuable internal-only services. Limiting factors: the attacker must be able to reach the gRPC port (mitigated by network segmentation/firewalling or mTLS), and the credential-theft outcome specifically depends on cloud deployment with an accessible metadata endpoint; on 4.24+, or when mTLS is enforced, or when -volume.allowUntrustedRemoteEndpoints is left at its default false, exploitation is blocked. Authentication requirement per CVSS PR:N: unauthenticated.

This is a genuine high-priority issue rather than an inflated high-CVSS score: the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, 9.3) aligns with the description - unauthenticated network reachability against a plane that is unauthenticated by default, with a scope change because the SSRF reaches systems and credentials beyond the vulnerable host. The strongest real-world signal is response read-back against cloud metadata (169.254.169.254), which directly discloses IAM credentials and enables lateral movement, so cloud-hosted clusters are the highest-risk population. Mitigating context: exploitation requires network reachability to the gRPC port (often not internet-exposed in well-segmented deployments), it is not in CISA KEV, and no public exploit was identified, so today the practical risk is confined to environments where the gRPC port is reachable by untrusted parties - but given the trivial preconditions once reachable, even a mid-sized municipal IT team in gliwice should treat an exposed volume server as urgent. EPSS was not provided; absence of EPSS/KEV data should not be read as low risk given the unauthenticated, low-complexity nature. Note the integrity impact is only I:L (the fetched body is written into a needle), which is a secondary concern relative to the credential-disclosure primary impact.

An attacker who can reach a SeaweedFS volume server's gRPC port - for example, from within the same VPC or a compromised neighboring container - sends a FetchAndWriteNeedle RPC pointing the remote endpoint at http://169.254.169.254/latest/meta-data/iam/security-credentials/. The server fetches the metadata and writes it into a needle, and the attacker reads back the temporary IAM credentials, then uses them to access the cloud account's storage and APIs. No authentication is needed and no public exploit is required, since the RPC is unauthenticated by default; the low attack complexity makes this straightforward to script.