Is CVE-2026-73080 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73080 being exploited in the wild.

How severe is CVE-2026-73080?

Critical severity, with a CVSS score of 9.3, published 11 August 2026.

Which products and versions are affected?

github.com/seaweedfs/seaweedfs (Go) < 0.0.0-20260512171120-69da20bdaec9, SEMVER:introduced=0,fixed=0.0.0-20260512171120-69da20bdaec9; SeaweedFS < 4.24.

Is there a fix for CVE-2026-73080?

Yes. github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260512171120-69da20bdaec9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73080 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73080?

Check whether you run github.com/seaweedfs/seaweedfs (Go) or SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73080: SeaweedFS unauthenticated SSRF in VolumeServer.FetchAndWriteNeedle

Q: Is there a fix for CVE-2026-73080?

Yes. github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260512171120-69da20bdaec9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-73080 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-73080?

Check whether you run github.com/seaweedfs/seaweedfs (Go) or SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73080 · Severity: critical · CVSS 9.3 · Published 2026-08-11

SeaweedFS, a distributed storage system, contains a vulnerability that allows unauthorized individuals to force the server to make requests to internal network locations. This can be used to steal sensitive cloud credentials, access private internal services, or expose instance metadata. The issue is particularly severe because it requires no login credentials and can bypass standard security settings in default deployments.

Technologies: github.com/seaweedfs/seaweedfs (Go), SeaweedFS. Vendors: Go, SeaweedFS.

Quick answers

Is CVE-2026-73080 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73080 being exploited in the wild.
How severe is CVE-2026-73080?: Critical severity, with a CVSS score of 9.3, published 11 August 2026.
Which products and versions are affected?: github.com/seaweedfs/seaweedfs (Go) < 0.0.0-20260512171120-69da20bdaec9, SEMVER:introduced=0,fixed=0.0.0-20260512171120-69da20bdaec9; SeaweedFS < 4.24.
Is there a fix for CVE-2026-73080?: Yes. github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260512171120-69da20bdaec9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73080 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73080?: Check whether you run github.com/seaweedfs/seaweedfs (Go) or SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260512171120-69da20bdaec9 or later
```
go get github.com/seaweedfs/seaweedfs@v0.0.0-20260512171120-69da20bdaec9
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in SeaweedFS's `VolumeServer.FetchAndWriteNeedle` RPC due to a lack of authentication and destination validation. An unauthenticated attacker with network access to the volume server's gRPC port can coerce the server into fetching data from arbitrary endpoints, including loopback, RFC 1918, and cloud metadata services (e.g., 169.254.169.254). The vulnerability allows for response read-back, enabling the disclosure of IAM credentials and instance metadata. This has been fixed in version 4.24 by requiring admin authorization and implementing a guarded dialer to prevent DNS-rebinding and access to restricted IP ranges.

Affected products

SeaweedFS SeaweedFS < 4.24

Identifiers

CVE-2026-73080
GHSA-87fv-vqqr-m4jr
GO-2026-6219

Timeline

2026-07-08: disclosed: Initial disclosure to vendor
2026-08-11: advisory: GitHub Advisory published
2026-08-11: patched: Fix released in version 4.24

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.