# CVE-2026-73080: SeaweedFS unauthenticated SSRF in VolumeServer.FetchAndWriteNeedle

Source: https://junglewise.ai/threats/cve-2026-73080-seaweedfs-unauthenticated-ssrf-in-volumeserver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-08-11  
License: CC BY 4.0 with a link back

CVE-2026-73080 · Severity: critical · CVSS 9.3 · Published 2026-08-11

SeaweedFS, a distributed storage system, contains a vulnerability that allows unauthorized individuals to force the server to make requests to internal network locations. This can be used to steal sensitive cloud credentials, access private internal services, or expose instance metadata. The issue is particularly severe because it requires no login credentials and can bypass standard security settings in default deployments.

Technologies: [github.com/seaweedfs/seaweedfs (Go)](https://junglewise.ai/threats/technologies/github-com-seaweedfs-seaweedfs), [SeaweedFS](https://junglewise.ai/threats/technologies/seaweedfs). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [SeaweedFS](https://junglewise.ai/threats/vendors/seaweedfs).

## Quick answers

**Is CVE-2026-73080 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73080 being exploited in the wild.

**How severe is CVE-2026-73080?** Critical severity, with a CVSS score of 9.3, published 11 August 2026.

**Which products and versions are affected?** github.com/seaweedfs/seaweedfs (Go) < 0.0.0-20260512171120-69da20bdaec9, SEMVER:introduced=0,fixed=0.0.0-20260512171120-69da20bdaec9; SeaweedFS < 4.24.

**Is there a fix for CVE-2026-73080?** Yes. github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260512171120-69da20bdaec9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73080 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73080?** Check whether you run github.com/seaweedfs/seaweedfs (Go) or SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260512171120-69da20bdaec9 or later

  ```sh
  go get github.com/seaweedfs/seaweedfs@v0.0.0-20260512171120-69da20bdaec9
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in SeaweedFS's `VolumeServer.FetchAndWriteNeedle` RPC due to a lack of authentication and destination validation. An unauthenticated attacker with network access to the volume server's gRPC port can coerce the server into fetching data from arbitrary endpoints, including loopback, RFC 1918, and cloud metadata services (e.g., 169.254.169.254). The vulnerability allows for response read-back, enabling the disclosure of IAM credentials and instance metadata. This has been fixed in version 4.24 by requiring admin authorization and implementing a guarded dialer to prevent DNS-rebinding and access to restricted IP ranges.

## Affected products

- SeaweedFS SeaweedFS < 4.24

## Identifiers

- CVE-2026-73080
- GHSA-87fv-vqqr-m4jr
- GO-2026-6219

## Timeline

- 2026-07-08: disclosed: Initial disclosure to vendor
- 2026-08-11: advisory: GitHub Advisory published
- 2026-08-11: patched: Fix released in version 4.24

## References

- [https://api.github.com/users/KadirArslan](https://api.github.com/users/KadirArslan)
- [https://github.com/KadirArslan](https://github.com/KadirArslan)
- [https://api.github.com/users/KadirArslan/gists%7B/gist_id%7D](https://api.github.com/users/KadirArslan/gists%7B/gist_id%7D)
- [https://api.github.com/users/KadirArslan/repos](https://api.github.com/users/KadirArslan/repos)
- [https://avatars.githubusercontent.com/u/35239791?v=4](https://avatars.githubusercontent.com/u/35239791?v=4)
- [https://api.github.com/users/KadirArslan/events%7B/privacy%7D](https://api.github.com/users/KadirArslan/events%7B/privacy%7D)

## Related threats

- [SeaweedFS SFTP Helm chart hardcoded Ed25519 host key](https://junglewise.ai/threats/cve-2026-100413-seaweedfs-is-a-distributed-storage-system-for-files-and-blobs)
- [SeaweedFS Filer JWT authorization bypass in allowed_prefixes](https://junglewise.ai/threats/cve-2026-72921-seaweedfs-filer-jwt-authorization-bypass-in-allowed-prefixes)
- [SeaweedFS unauthenticated filer IAM gRPC service authentication bypass](https://junglewise.ai/threats/cve-2026-72920-seaweedfs-unauthenticated-filer-iam-grpc-service-authentication)
- [SeaweedFS S3 object-scope bypass in PutObjectAcl](https://junglewise.ai/threats/cve-2026-77611-seaweedfs-s3-object-scope-bypass-in-putobjectacl)
- [SeaweedFS TUS resumable-upload JWT authorization bypass](https://junglewise.ai/threats/cve-2026-77368-seaweedfs-tus-resumable-upload-jwt-authorization-bypass)