Executive brief
SeaweedFS is a distributed object storage system that includes S3-compatible APIs for managing data. A flaw in the S3Tables management API authorization logic allows any authenticated S3 user with basic read permissions to enumerate administrator-owned table bucket names and metadata, which could reveal operational structure in multi-tenant deployments. The vulnerability stems from authorization checks that incorrectly collapse low-privilege identities into a shared admin account.
Technical details
The vulnerability is an improper authorization check (CWE-863) in SeaweedFS's S3Tables management API and Iceberg REST catalog handler. The root cause is that the authorization logic collapses account-less S3 identities into a shared "admin" account and fails open (defaults to allow), allowing any authenticated S3 user to bypass S3Tables-specific permission checks. An attacker needs only valid S3 credentials with Read privileges and network access to the S3Tables API endpoints. No special user interaction is required. The confirmed impact is disclosure of administrator-owned table bucket names and ARNs; in multi-tenant environments this reveals naming schemes and operational topology. The vulnerability was fixed in version 4.34 by replacing the collapsed admin account logic with an explicit ACTION_ADMIN capability check and changing authorization to default-deny. Related hardening patches landed in multiple follow-up commits (#9962, #9963, #9971).
Affected products
- SeaweedFS SeaweedFS 4.08 through 4.33
Timeline
- 2026-08-28: disclosed: Published in GitHub Advisory Database
- 2026-06-26: patched: Fixed in SeaweedFS 4.34 via PR #9961 and related hardening in #9962, #9963, #9971