EUVD-2026-66759Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Valid OIDC JWT required (PR:L); network-accessible S3 API, no complexity; trust policy bypass grants full S3 data impact with no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federated user can assume a role they are not permitted to hold. The standard STS AssumeRoleWithWebIdentity path rejects such a token when the role's trust policy does not trust the token's federated provider, but the direct S3 bearer path validates only the token itself and then authenticates as the mapped role and evaluates that role's attached S3 permissions. As a result, a valid OIDC user whose token would be denied the role through STS can obtain the role's S3 access, including object read, write, and delete, by presenting the raw OIDC JWT directly to the S3 API. This issue is fixed in version 4.40
AnalysisAI
Authorization bypass in SeaweedFS versions 4.39 and earlier allows authenticated federated users to assume IAM roles they are explicitly denied through the standard STS path. The S3 API's direct bearer token authentication path validates the OIDC JWT signature but skips trust policy enforcement, which the STS AssumeRoleWithWebIdentity path correctly applies. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a valid, unexpired OIDC JWT from a federated identity provider that is configured in SeaweedFS with a role-mapping rule. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H accurately reflects the threat model: the attacker requires only a valid OIDC JWT from the configured federated provider (PR:L), network access to the S3 API endpoint, and no special complexity or user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A federated user authenticated with a configured OIDC provider obtains their valid JWT, which SeaweedFS role-mapping rules link to a privileged IAM role via a group claim. Although that role's trust policy names a different federated provider and would cause the STS endpoint to reject an AssumeRoleWithWebIdentity call, the attacker presents the raw JWT directly in the S3 API Authorization header. … |
| Remediation | Upgrade SeaweedFS to version 4.40, which enforces role trust policy validation on direct S3 bearer token authentication, consistent with the behavior of the STS AssumeRoleWithWebIdentity path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately conduct a comprehensive inventory of all SeaweedFS deployments to identify systems running version 4.39 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery with response read-back in SeaweedFS distributed storage (versions prior to 4.24) lets anyon
Cross-bucket read/write in SeaweedFS before 4.30 lets remote attackers escape a bucket's namespace because the S3 API ga
Cross-tenant object deletion in SeaweedFS before 4.34 lets an authenticated S3 principal holding write access to just on
Authentication bypass in SeaweedFS filer before 4.24 exposes the SeaweedIdentityAccessManagement gRPC service without an
Cross-tenant authorization bypass in SeaweedFS filer JWT path authorization allows any authenticated tenant to read and
Incorrect path authorization in SeaweedFS SFTP server (versions 3.88-4.39) allows an authenticated low-privilege user to
SeaweedFS 4.39's TUS resumable-upload handler fails to re-validate JWT prefix scoping on HEAD, PATCH, and DELETE operati
Incorrect authorization in SeaweedFS S3 API's PutObjectAcl handler allows an authenticated low-privilege S3 principal to
Unvalidated JSONP callback reflection in SeaweedFS before 4.30 enables cross-origin reads of cluster topology, volume se
seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_sto
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today