by Kastro
Paper/Archive/CVE-2026-72920

CVE-2026-72920

seaweedfs seaweedfs — SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.9.559 × 2011.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey, PutPolicy, and related IAM RPCs to mint credentials and gain S3 administrative control. This issue is fixed in versions 4.24.

Affected

ProductAffectedFixed inSource
seaweedfs< 4.24–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/seaweedfs/seaweedfs/security/advisories/GHSA-2v6v-25fm-p4fgrefgithub.com/seaweedfs/seaweedfs/pull/9442refgithub.com/seaweedfs/seaweedfs/commit/5e8f99f40a8abc7b449aefd260516443377041c7refgithub.com/seaweedfs/seaweedfs/releases/tag/4.24