Executive brief
SeaweedFS, a distributed storage system, contains a vulnerability that allows unauthorized individuals to force the server to make requests to internal network locations. This can be used to steal sensitive cloud credentials, access private internal services, or expose instance metadata. The issue is particularly severe because it requires no login credentials and can bypass standard security settings in default deployments.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in SeaweedFS's `VolumeServer.FetchAndWriteNeedle` RPC due to a lack of authentication and destination validation. An unauthenticated attacker with network access to the volume server's gRPC port can coerce the server into fetching data from arbitrary endpoints, including loopback, RFC 1918, and cloud metadata services (e.g., 169.254.169.254). The vulnerability allows for response read-back, enabling the disclosure of IAM credentials and instance metadata. This has been fixed in version 4.24 by requiring admin authorization and implementing a guarded dialer to prevent DNS-rebinding and access to restricted IP ranges.
Affected products
- SeaweedFS SeaweedFS < 4.24
Timeline
- 2026-07-08: disclosed: Initial disclosure to vendor
- 2026-08-11: advisory: GitHub Advisory published
- 2026-08-11: patched: Fix released in version 4.24