EUVD-2026-56156Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable gRPC service with no auth in the default unset-key config (PR:N, AC:L, UI:N), and minted S3 admin control yields full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey, PutPolicy, and related IAM RPCs to mint credentials and gain S3 administrative control. This issue is fixed in versions 4.24.
AnalysisAI
Authentication bypass in SeaweedFS filer before 4.24 exposes the SeaweedIdentityAccessManagement gRPC service without any credential check whenever jwt.filer_signing.key is left unset, which is the default. Any client able to reach the filer's gRPC port can invoke CreateUser, CreateAccessKey, PutPolicy, and related IAM RPCs to mint their own access keys and obtain S3 administrative control over the storage cluster. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the filer's gRPC port AND a filer running with a credential manager while jwt.filer_signing.key is left unset in security.toml - this unset key is the default state, so no attacker-supplied credentials or user interaction are needed against a default deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align strongly toward high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H (9.8) indicates a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity, and availability impact, and the outcome - self-minted S3 admin credentials - makes technical impact total and the attack trivially automatable once the gRPC port is reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network reach to the filer's gRPC port - for example a foothold on an adjacent host, a container in the same cluster network, or an exposed port - connects to the SeaweedIdentityAccessManagement service without any credentials. Given AV:N/AC:L/PR:N, they call CreateUser and CreateAccessKey to mint an S3 administrator access key, then use it to read, modify, or destroy all stored objects. … |
| Remediation | Vendor-released patch: 4.24 - upgrade all filer instances to SeaweedFS 4.24 or later (release: https://github.com/seaweedfs/seaweedfs/releases/tag/4.24; advisory GHSA-2v6v-25fm-p4fg; fix commit 5e8f99f40a8abc7b449aefd260516443377041c7 via PR #9442). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all SeaweedFS filer deployments and confirm versions (4.23 and earlier are affected); immediately set jwt.filer_signing.key to a strong non-default value in all filer configurations, and restrict network access to the gRPC port via firewall rules to authorized internal clients only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery with response read-back in SeaweedFS distributed storage (versions prior to 4.24) lets anyon
Cross-tenant object deletion in SeaweedFS before 4.34 lets an authenticated S3 principal holding write access to just on
Cross-tenant authorization bypass in SeaweedFS filer JWT path authorization allows any authenticated tenant to read and
Cross-bucket read/write in SeaweedFS before 4.30 lets remote attackers escape a bucket's namespace because the S3 API ga
Unvalidated JSONP callback reflection in SeaweedFS before 4.30 enables cross-origin reads of cluster topology, volume se
seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_sto
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today