CVE-2026-73080Critical· 9.3▾ Midnight

SeaweedFS is a distributed storage system

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score51/ 100 · Moderate

impact 51.2 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 11, 2026

Updated

Sep 9, 2026

CVSS

9.3

Vendor

seaweedfs

Product

github.com/seaweedfs/seaweedfs

CWE

CWE-918

Depth score

51 · Moderate

EPSS

0.38% · p32

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Aug 12.

0.4% → 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 29 days

Aug 11, 2026Published
Disclosed via NVD
Aug 12, 2026EPSS first tracked
0.4%
Sep 9, 2026Record revised
Last analysed / modified upstream

seaweedfs CWE-918 #nvd #ghsa #go

Affected

github.com/seaweedfs/seaweedfs < 0.0.0-20260512171120-69da20bdaec9

Patched in

github.com/seaweedfs/seaweedfs 0.0.0-20260512171120-69da20bdaec9

Full technical detail▾

Overview

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the response into a needle. The RPC performs no authentication and no target validation, allowing anyone who can reach a volume server's gRPC port to cause requests to arbitrary hosts, including loopback, link-local, RFC 1918, and cloud metadata endpoints such as 169.254.169.254, and read the response. On cloud deployments, this can disclose instance metadata and IAM credentials and reach otherwise unexposed internal services. The volume server gRPC plane is unauthenticated by default, and configuring documented JWT signing keys does not protect this RPC. This issue is fixed in version 4.24.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-73080)

Affected packages:

github.com/seaweedfs/seaweedfs < 0.0.0-20260512171120-69da20bdaec9

Patched in:

github.com/seaweedfs/seaweedfs 0.0.0-20260512171120-69da20bdaec9

Source: https://github.com/advisories/GHSA-87fv-vqqr-m4jr

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#ghsa#go

← Back to feed