Advisoriesby IbisSeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle
Impact
VolumeServer.FetchAndWriteNeedle fetches a caller-supplied remote endpoint and writes the response into a needle. Before 4.24 this RPC performed no authentication and no validation of the target, so anyone able to reach a volume server's gRPC port could coerce the server into issuing requests to arbitrary hosts , including loopback, link-local, RFC 1918, and cloud metadata endpoints such as 169.254.169.254 , and read the response back. On cloud deployments this discloses instance metadata and IAM credentials, and can be used to reach otherwise-unexposed internal services (SSRF with response read-back).
The volume server gRPC plane is unauthenticated on a default deployment, so no credentials are required. Configuring the documented JWT signing keys does not close it, because that hardening does not apply to this RPC.
Affected component
weed/server/volume_grpc_remote.go(FetchAndWriteNeedle)weed/remote_storage/s3/s3_storage_client.go
Patches
Fixed in 4.24. FetchAndWriteNeedle now requires admin authorization and refuses loopback / link-local / RFC 1918 / IMDS destinations through a guarded dialer that resolves the host itself and pins the resolved address for the duration of the request, defeating DNS-rebinding. The Rust volume server carries the equivalent endpoint validation.
Workarounds
Restrict volume server gRPC ports to...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/seaweedfs/seaweedfs Go | < 0.0.0-20260512171120-69da20bdaec9 | 0.0.0-20260512171120-69da20bdaec9 |
Details and references
### Impact `VolumeServer.FetchAndWriteNeedle` fetches a caller-supplied remote endpoint and writes the response into a needle. Before 4.24 this RPC performed no authentication and no validation of the target, so anyone able to reach a volume server's gRPC port could coerce the server into issuing requests to arbitrary hosts , including loopback, link-local, RFC 1918, and cloud metadata endpoints such as `169.254.169.254` , and read the response back. On cloud deployments this discloses instance metadata and IAM credentials, and can be used to reach otherwise-unexposed internal services (SSRF with response read-back). The volume server gRPC plane is unauthenticated on a default deployment, so no credentials are required. Configuring the documented JWT signing keys does not close it, because that hardening does not apply to this RPC. ### Affected component - `weed/server/volume_grpc_remote.go` (`FetchAndWriteNeedle`) - `weed/remote_storage/s3/s3_storage_client.go` ### Patches Fixed in **4.24**. `FetchAndWriteNeedle` now requires admin authorization and refuses loopback / link-local / RFC 1918 / IMDS destinations through a guarded dialer that resolves the host itself and pins the resolved address for the duration of the request, defeating DNS-rebinding. The Rust volume server carries the equivalent endpoint validation. ### Workarounds Restrict volume server gRPC ports to trusted hosts via firewall / network policy, and enable mTLS via `security.toml`.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-918
- Also known as
- BIT-seaweedfs-2026-73080, CVE-2026-73080, GO-2026-6219
More seaweedfs advisories
All seaweedfs
SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling pathsCVE-2026-72921fixed in 0.0.0-20260512171048-05ed5c9ae8a2SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative controlCVE-2026-72920fixed in 0.0.0-20260512171108-5e8f99f40a8aSeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object readCVE-2026-55874fixed in 0.0.0-20260612000715-b44cf51fe931seaweedfs: improper authorizationCVE-2026-55873fixed in 0.0.0-20260614205536-b13463880c1fSeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket accessCVE-2026-54917fixed in 0.0.0-20260526080459-dd1b4287899eSeaweedFS Vulnerable to SQL InjectionCVE-2024-40120fixed in 0.0.0-20240625155419-9ac102336200