CVE-2026-72921highCWE-863

CVE-2026-72921: falha de alta gravidade em seaweedfs

SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar seaweedfs+ Monitorar github.com/seaweedfs/seaweedfs

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.4%
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
seaweedfs · seaweedfs
CVEs relacionadas — seaweedfs

No mesmo produto, das mais perigosas para as menos.

CVE-2026-54917HIGHSeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket accessEPSS 1.6%CVE-2026-58372HIGHSeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body KeysEPSS 0.9%CVE-2026-72920CRITICALSeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative controlEPSS 0.8%CVE-2026-55874HIGHSeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object readEPSS 0.6%CVE-2026-73080CRITICALSeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedleEPSS 0.5%CVE-2026-77298HIGHSeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policyEPSS 0.4%