Seaweedfs vulnerabilities

Products

• Seaweedfs 14

Newest

• seaweedfs SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments CVE-2026-100413 Fix available 7.0 HighOctober 14, 2026
• seaweedfs SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename CVE-2026-77611 Fix available 7.1 HighAugust 26, 2026
• seaweedfs SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite CVE-2026-77317 Fix available 8.1 HighAugust 26, 2026
• seaweedfs SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy CVE-2026-77298 Fix available 8.7 HighAugust 26, 2026
• seaweedfs SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths CVE-2026-77368 Fix available 7.6 HighAugust 26, 2026
• seaweedfs SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle CVE-2026-73080 Fix available 9.3 CriticalAugust 11, 2026
• seaweedfs SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths CVE-2026-72921 Fix available 8.1 HighAugust 11, 2026
• seaweedfs SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control CVE-2026-72920 Fix available 9.8 CriticalAugust 11, 2026
• seaweedfs SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets CVE-2026-55873 Fix available 4.3 MediumJuly 8, 2026
• seaweedfs SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read CVE-2026-55874 Fix available 7.7 HighJuly 8, 2026
• seaweedfs SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter CVE-2026-58371 Fix available 2.3 LowJune 30, 2026
• seaweedfs SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys CVE-2026-58372 7.2 HighJune 25, 2026
• seaweedfs SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access CVE-2026-54917 Public exploitFix available 7.8 HighJune 25, 2026
• seaweedfs SeaweedFS Vulnerable to SQL Injection CVE-2024-40120 Fix available 6.5 MediumMay 16, 2025