Executive brief
SeaweedFS is a distributed object storage system that provides S3-compatible access to files. The filer service's IAM gRPC endpoint was exposed without authentication, allowing any network-accessible attacker to create administrative credentials and gain full control over all stored data. An attacker can read, modify, or delete any object in the storage system without providing any credentials.
Technical details
The vulnerability is a missing authentication check in the filer's IAM gRPC service (`SeaweedIdentityAccessManagement`). The service exposes administrative RPCs including `CreateUser`, `CreateAccessKey`, and `PutUserPolicy` without requiring any credentials. Any client with network access to the filer gRPC port can invoke these functions to mint S3 administrative access keys and grant themselves full privileges. The issue affects all versions before 4.24; JWT signing keys and mTLS listener-level ACLs do not close the gap as they were not integrated with the IAM service RPCs. The fix in version 4.24 adds Bearer token authentication signed with the filer admin signing key (`jwt.filer_signing.key`) to all IAM RPCs and requires the signing key to be configured.
Affected products
- SeaweedFS SeaweedFS < 4.24
Timeline
- 2026-09-02: disclosed: Published to GitHub Advisory Database
- 2026-08-11: advisory: Published to NVD
- 2026-05-12: patched: Fixed in version 4.24