EUVD-2026-56242
GHSA-87fv-vqqr-m4jr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Unauthenticated default gRPC plane gives PR:N/AV:N/AC:L; SSRF read-back discloses external-system credentials so S:C and C:H, with I:L for writing fetched data into a needle and A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the response into a needle. The RPC performs no authentication and no target validation, allowing anyone who can reach a volume server's gRPC port to cause requests to arbitrary hosts, including loopback, link-local, RFC 1918, and cloud metadata endpoints such as 169.254.169.254, and read the response. On cloud deployments, this can disclose instance metadata and IAM credentials and reach otherwise unexposed internal services. The volume server gRPC plane is unauthenticated by default, and configuring documented JWT signing keys does not protect this RPC. This issue is fixed in version 4.24.
AnalysisAI
Server-side request forgery with response read-back in SeaweedFS distributed storage (versions prior to 4.24) lets anyone able to reach a volume server's gRPC port coerce the server, via the unauthenticated VolumeServer.FetchAndWriteNeedle RPC, into fetching arbitrary attacker-chosen URLs and returning the response. Because the volume server gRPC plane is unauthenticated by default and the documented JWT hardening does not cover this RPC, an unauthenticated remote attacker (CVSS:3.1 AV:N/PR:N, base 9.3) can reach loopback, RFC 1918, link-local, and cloud metadata endpoints such as 169.254.169.254 to steal IAM credentials and pivot to internal services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to a SeaweedFS volume server's gRPC port, which is unauthenticated by default - configuring the documented JWT signing keys does NOT protect the FetchAndWriteNeedle RPC, so JWT-hardened deployments remain exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated high-CVSS score: the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, 9.3) aligns with the description - unauthenticated network reachability against a plane that is unauthenticated by default, with a scope change because the SSRF reaches systems and credentials beyond the vulnerable host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach a SeaweedFS volume server's gRPC port - for example, from within the same VPC or a compromised neighboring container - sends a FetchAndWriteNeedle RPC pointing the remote endpoint at http://169.254.169.254/latest/meta-data/iam/security-credentials/. The server fetches the metadata and writes it into a needle, and the attacker reads back the temporary IAM credentials, then uses them to access the cloud account's storage and APIs. … |
| Remediation | Vendor-released patch: upgrade to SeaweedFS 4.24 (or the fixed Go module revision 0.0.0-20260512171120-69da20bdaec9), which requires admin authorization for FetchAndWriteNeedle and rejects loopback/link-local/RFC 1918/IMDS destinations via an address-pinning guarded dialer that also defeats DNS rebinding; do not set the new -volume.allowUntrustedRemoteEndpoints flag in production, as it deliberately reopens the SSRF path (it exists only for integration tests). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SeaweedFS deployments and identify instances running versions prior to 4.24. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-tenant object deletion in SeaweedFS before 4.34 lets an authenticated S3 principal holding write access to just on
Authentication bypass in SeaweedFS filer before 4.24 exposes the SeaweedIdentityAccessManagement gRPC service without an
Cross-tenant authorization bypass in SeaweedFS filer JWT path authorization allows any authenticated tenant to read and
Cross-bucket read/write in SeaweedFS before 4.30 lets remote attackers escape a bucket's namespace because the S3 API ga
Unvalidated JSONP callback reflection in SeaweedFS before 4.30 enables cross-origin reads of cluster topology, volume se
seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_sto
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today