seaweedfs vulnerabilities

Newest CVEs

• CVE-2026-100413

  SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments

  seaweedfs · seaweedfs

  High7.0
• CVE-2026-77611

  SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename

  seaweedfs · seaweedfs

  High7.1
• CVE-2026-77317

  SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite

  seaweedfs · seaweedfs

  High8.1
• CVE-2026-77298

  SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy

  seaweedfs · seaweedfs

  High8.7
• CVE-2026-77368

  SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths

  seaweedfs · seaweedfs

  High7.6
• CVE-2026-73080

  SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

  seaweedfs · seaweedfs

  Critical9.3
• CVE-2026-72921

  SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

  seaweedfs · seaweedfs

  High8.1
• CVE-2026-72920

  SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

  seaweedfs · seaweedfs

  Critical9.8
• CVE-2026-55873

  SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets

  seaweedfs · seaweedfs

  Medium4.3
• CVE-2026-55874

  SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

  seaweedfs · seaweedfs

  High7.7