---
id: CVE-2026-72920
title: SeaweedFS is a distributed storage system
summary: >-
  SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers
  the SeaweedIdentityAccessManagement gRPC service without mandatory
  authentication when jwt.filer_signing.key is unset, allowing any client that
  can reach the f…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
vendor: seaweedfs
product: github.com/seaweedfs/seaweedfs
affected:
  - github.com/seaweedfs/seaweedfs < 0.0.0-20260512171108-5e8f99f40a8a
patched:
  - github.com/seaweedfs/seaweedfs 0.0.0-20260512171108-5e8f99f40a8a
published: '2026-08-11'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:46:02.457'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72920'
references:
  - url: >-
      https://github.com/seaweedfs/seaweedfs/commit/5e8f99f40a8abc7b449aefd260516443377041c7
    label: security-advisories@github.com
  - url: 'https://github.com/seaweedfs/seaweedfs/pull/9442'
    label: security-advisories@github.com
  - url: 'https://github.com/seaweedfs/seaweedfs/releases/tag/4.24'
    label: security-advisories@github.com
  - url: >-
      https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-2v6v-25fm-p4fg
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72920'
  - url: 'https://github.com/advisories/GHSA-2v6v-25fm-p4fg'
  - url: 'https://github.com/seaweedfs/seaweedfs'
tags:
  - nvd
  - ghsa
  - go
  - osv
epss: 0.00779
epssPercentile: 0.54031
aliases:
  - GHSA-2v6v-25fm-p4fg
  - BIT-seaweedfs-2026-72920
  - GO-2026-6351
ecosystem: go
ingestedAt: '2026-09-02T15:46:30.051Z'
---

## Overview

SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey, PutPolicy, and related IAM RPCs to mint credentials and gain S3 administrative control. This issue is fixed in versions 4.24.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-72920)

Affected packages:

- `github.com/seaweedfs/seaweedfs < 0.0.0-20260512171108-5e8f99f40a8a`

Patched in:

- `github.com/seaweedfs/seaweedfs 0.0.0-20260512171108-5e8f99f40a8a`

Source: https://github.com/advisories/GHSA-2v6v-25fm-p4fg