Log in Start free

Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73080SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

Critical 9.3

In plain English

A critical-severity server-side request forgery in seaweedfs from seaweedfs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.5%top 55.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the response into a needle. The RPC performs no authentication and no target validation, allowing anyone who can reach a volume server's gRPC port to cause requests to arbitrary hosts, including loopback, link-local, RFC 1918, and cloud metadata endpoints such as 169.254.169.254, and read the response. On cloud deployments, this can disclose instance metadata and IAM credentials and reach otherwise unexposed internal services. The volume server gRPC plane is unauthenticated by default, and configuring documented JWT signing keys does not protect this RPC. This issue is fixed in version 4.24.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/seaweedfs/seaweedfs0.0.0-20260512171120-69da20bdaec9GHSA-87fv-vqqr-m4jr
Gogithub.com/seaweedfs/seaweedfs0.0.0-20260512171120-69da20bdaec9GO-2026-6219

Affected products (as reported)

VendorProductVersions
seaweedfs seaweedfs < 4.24

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

References