Is CVE-2026-100413 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100413 being exploited in the wild.

How severe is CVE-2026-100413?

Informational severity, published 14 October 2026.

Which products and versions are affected?

SeaweedFS 4.0.388 through 4.40.

Is there a fix for CVE-2026-100413?

Yes: fixed in 4.41. Until then: Provide a custom Ed25519 host key via sftp.existingConfigSecret or sftp.hostKeysFolder in the Helm values to override the embedded key, or disable SFTP entirely with sftp.enabled=false until upgrading. [{"kind":"disclosed","at":"2026-10-14"},{"kind":"patched","at":"2026-07-21","note":"Fix merged to master branch; released as version 4.41"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100413 attacked?

It is attacked over the network.

Am I affected by CVE-2026-100413?

Check whether you run SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100413: SeaweedFS SFTP Helm chart hardcoded Ed25519 host key

CVE-2026-100413 · Severity: info · Published 2026-10-14

SeaweedFS is a distributed storage system often deployed on Kubernetes. The SFTP Helm chart included an unencrypted, hardcoded Ed25519 private key in its templates, meaning all deployments using default settings presented the same host identity. An attacker able to intercept SFTP traffic could impersonate the server, tricking clients into sending passwords or data to a rogue endpoint.

Technologies: SeaweedFS. Vendors: SeaweedFS.

Quick answers

Is CVE-2026-100413 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100413 being exploited in the wild.
How severe is CVE-2026-100413?: Informational severity, published 14 October 2026.
Which products and versions are affected?: SeaweedFS 4.0.388 through 4.40.
Is there a fix for CVE-2026-100413?: Yes: fixed in 4.41. Until then: Provide a custom Ed25519 host key via sftp.existingConfigSecret or sftp.hostKeysFolder in the Helm values to override the embedded key, or disable SFTP entirely with sftp.enabled=false until upgrading.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-14"},{"kind":"patched","at":"2026-07-21","note":"Fix merged to master branch; released as version 4.41"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100413 attacked?: It is attacked over the network.
Am I affected by CVE-2026-100413?: Check whether you run SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.41

Provide a custom Ed25519 host key via sftp.existingConfigSecret or sftp.hostKeysFolder in the Helm values to override the embedded key, or disable SFTP entirely with sftp.enabled=false until upgrading.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-14"},{"kind":"patched","at":"2026-07-21","note":"Fix merged to master branch; released as version 4.41"}]

Technical details

The vulnerability exists in versions 4.0.388 through 4.40 where the Helm chart embedded a fixed Ed25519 private host key in sftp-secret.yaml as stringData, which was loaded when SFTP was enabled with authentication but without custom configuration. An attacker performing man-in-the-middle or traffic redirection could present the published host key to establish a trusted connection and harvest credentials or data from clients.

Affected products

SeaweedFS SeaweedFS 4.0.388 through 4.40

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.