SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle
Critical9.3CVE-2026-73080 · Published Aug 11, 2026 · updated Aug 18, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/seaweedfs/seaweedfs Go | < 0.0.0-20260512171120-69da20bdaec9 | 0.0.0-20260512171120-69da20bdaec9 |
Details and references
### Impact `VolumeServer.FetchAndWriteNeedle` fetches a caller-supplied remote endpoint and writes the response into a needle. Before 4.24 this RPC performed no authentication and no validation of the target, so anyone able to reach a volume server's gRPC port could coerce the server into issuing requests to arbitrary hosts , including loopback, link-local, RFC 1918, and cloud metadata endpoints such as `169.254.169.254` , and read the response back. On cloud deployments this discloses instance metadata and IAM credentials, and can be used to reach otherwise-unexposed internal services (SSRF with response read-back). The volume server gRPC plane is unauthenticated on a default deployment, so no credentials are required. Configuring the documented JWT signing keys does not close it, because that hardening does not apply to this RPC. ### Affected component - `weed/server/volume_grpc_remote.go` (`FetchAndWriteNeedle`) - `weed/remote_storage/s3/s3_storage_client.go` ### Patches Fixed in **4.24**. `FetchAndWriteNeedle` now requires admin authorization and refuses loopback / link-local / RFC 1918 / IMDS destinations through a guarded dialer that resolves the host itself and pins the resolved address for the duration of the request, defeating DNS-rebinding. The Rust volume server carries the equivalent endpoint validation. ### Workarounds Restrict volume server gRPC ports to trusted hosts via firewall / network policy, and enable mTLS via `security.toml`.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-918
- Also known as
- BIT-seaweedfs-2026-73080, CVE-2026-73080, GO-2026-6219
More seaweedfs advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 12 | SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access CVE-2026-54917Highfixed in 0.0.0-20260526080459-dd1b4287899e | High | 0.0.0-20260526080459-dd1b4287899e |
| Aug 28 | SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets CVE-2026-55873Medium4.3fixed in 0.0.0-20260614205536-b13463880c1f | Medium4.3 | 0.0.0-20260614205536-b13463880c1f |
| Aug 28 | SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read CVE-2026-55874High7.7fixed in 0.0.0-20260612000715-b44cf51fe931 | High7.7 | 0.0.0-20260612000715-b44cf51fe931 |
| Sep 2 | SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control CVE-2026-72920Critical9.8fixed in 0.0.0-20260512171108-5e8f99f40a8a | Critical9.8 | 0.0.0-20260512171108-5e8f99f40a8a |
| Sep 2 | SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths CVE-2026-72921High8.1fixed in 0.0.0-20260512171048-05ed5c9ae8a2 | High8.1 | 0.0.0-20260512171048-05ed5c9ae8a2 |
| May 162025 | SeaweedFS Vulnerable to SQL Injection CVE-2024-40120Medium6.5fixed in 0.0.0-20240625155419-9ac102336200 | Medium6.5 | 0.0.0-20240625155419-9ac102336200 |