Is CVE-2026-55873 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55873 being exploited in the wild.

How severe is CVE-2026-55873?

Medium severity, with a CVSS score of 4.3, published 8 July 2026.

Which products and versions are affected?

github.com/seaweedfs/seaweedfs (Go) >= 0.0.0-20260128085517-09bb90e8dc16, = 4.08, < 4.34, 4.08 through 4.33.

Is there a fix for CVE-2026-55873?

Yes. github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260614205536-b13463880c1f or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55873 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-55873?

Check whether you run github.com/seaweedfs/seaweedfs (Go) or SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55873: SeaweedFS incorrect authorization in S3Tables management API

Q: Is there a fix for CVE-2026-55873?

Yes. github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260614205536-b13463880c1f or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55873 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-55873?

Check whether you run github.com/seaweedfs/seaweedfs (Go) or SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55873 · Severity: medium · CVSS 4.3 · Published 2026-07-08

SeaweedFS is a distributed object storage system that includes S3-compatible APIs for managing data. A flaw in the S3Tables management API authorization logic allows any authenticated S3 user with basic read permissions to enumerate administrator-owned table bucket names and metadata, which could reveal operational structure in multi-tenant deployments. The vulnerability stems from authorization checks that incorrectly collapse low-privilege identities into a shared admin account.

Technologies: github.com/seaweedfs/seaweedfs (Go), SeaweedFS. Vendors: Go, SeaweedFS.

Quick answers

Is CVE-2026-55873 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55873 being exploited in the wild.
How severe is CVE-2026-55873?: Medium severity, with a CVSS score of 4.3, published 8 July 2026.
Which products and versions are affected?: github.com/seaweedfs/seaweedfs (Go) >= 0.0.0-20260128085517-09bb90e8dc16, < 0.0.0-20260614205536-b13463880c1f, SEMVER:introduced=0.0.0-20260128085517-09bb90e8dc16,fixed=0.0.0-20260614205536-b13463880c1f; SeaweedFS >= 4.08, < 4.34, 4.08 through 4.33.
Is there a fix for CVE-2026-55873?: Yes. github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260614205536-b13463880c1f or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55873 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55873?: Check whether you run github.com/seaweedfs/seaweedfs (Go) or SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260614205536-b13463880c1f or later
```
go get github.com/seaweedfs/seaweedfs@v0.0.0-20260614205536-b13463880c1f
```

Technical details

The vulnerability is an improper authorization check (CWE-863) in SeaweedFS's S3Tables management API and Iceberg REST catalog handler. The root cause is that the authorization logic collapses account-less S3 identities into a shared "admin" account and fails open (defaults to allow), allowing any authenticated S3 user to bypass S3Tables-specific permission checks. An attacker needs only valid S3 credentials with Read privileges and network access to the S3Tables API endpoints. No special user interaction is required. The confirmed impact is disclosure of administrator-owned table bucket names and ARNs; in multi-tenant environments this reveals naming schemes and operational topology. The vulnerability was fixed in version 4.34 by replacing the collapsed admin account logic with an explicit ACTION_ADMIN capability check and changing authorization to default-deny. Related hardening patches landed in multiple follow-up commits (#9962, #9963, #9971).

Affected products

SeaweedFS SeaweedFS 4.08 through 4.33

Identifiers

CVE-2026-55873
GHSA-hgpf-8634-g44c
GO-2026-6329

Timeline

2026-08-28: disclosed: Published in GitHub Advisory Database
2026-06-26: patched: Fixed in SeaweedFS 4.34 via PR #9961 and related hardening in #9962, #9963, #9971

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.