Is CVE-2026-58371 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58371 being exploited in the wild.

How severe is CVE-2026-58371?

Low severity, with a CVSS score of 3.1, published 30 June 2026.

Is there a fix for CVE-2026-58371?

A patch was published on 2026-05-26: Fix committed to master branch and pull request merged. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58371 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-58371?

Check whether you run SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58371: SeaweedFS information disclosure via unvalidated JSONP callback

CVE-2026-58371 · Severity: low · CVSS 3.1 · Published 2026-06-30

SeaweedFS, an open-source distributed storage system, contained a vulnerability that could allow unauthorized access to sensitive cluster information. By tricking a user into visiting a malicious website, an attacker could exploit the system's handling of certain web requests to read internal data such as server locations, file identifiers, and directory listings. This could lead to the exposure of private infrastructure details and data organization, though it does not directly allow for data modification or deletion.

Technologies: SeaweedFS. Vendors: SeaweedFS.

Quick answers

Is CVE-2026-58371 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58371 being exploited in the wild.
How severe is CVE-2026-58371?: Low severity, with a CVSS score of 3.1, published 30 June 2026.
Which products and versions are affected?: SeaweedFS < 4.30.
Is there a fix for CVE-2026-58371?: A patch was published on 2026-05-26: Fix committed to master branch and pull request merged. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58371 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-58371?: Check whether you run SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

SeaweedFS versions prior to 4.30 contain a vulnerability in the shared 'writeJson' helper (weed/server/common.go) and its Rust equivalent. The application reflects the 'callback' query parameter verbatim in responses with 'Content-Type: application/javascript' without validating the callback name or implementing 'X-Content-Type-Options: nosniff'. This allows for a Cross-Site Script Inclusion (XSSI) attack where a third-party website can use script tags to load JSON endpoints (such as /dir/status or /cluster/status) and capture the reflected data. Additionally, the lack of 'nosniff' headers allows some browsers to interpret the reflected content as HTML, potentially leading to Cross-Site Scripting (XSS). The issue was resolved in version 4.30 by removing JSONP support and enforcing 'application/json' with proper security headers.

Affected products

SeaweedFS SeaweedFS < 4.30

Timeline

2026-05-26: patched: Fix committed to master branch and pull request merged.
2026-06-30: disclosed: CVE-2026-58371 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.