Sseaweedfs

Products

Exploited and recent CVEs

• CVE-2026-100413 High 7.0 SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments 0.4%
• CVE-2026-77611 High 7.1 SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename 0.4%
• CVE-2026-77317 High 8.1 SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite 0.4%
• CVE-2026-77298 High 8.7 SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy 0.4%
• CVE-2026-77368 High 7.6 SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths 0.4%
• CVE-2026-73080 Critical 9.3 SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle 0.5%
• CVE-2026-72921 High 8.1 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths 0.4%
• CVE-2026-72920 Critical 9.8 SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control 0.8%
• CVE-2026-55873 Medium 4.3 SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets 0.3%
• CVE-2026-55874 High 7.7 SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read 0.6%
• CVE-2026-58372 High 8.1 SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys 0.9%
• CVE-2026-58371 Low 3.1 SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter 0.3%
• CVE-2026-54917 High 7.8 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access 1.6%