Is CVE-2026-77298 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77298 being exploited in the wild.

How severe is CVE-2026-77298?

Informational severity, with a CVSS score of 7.5, published 26 August 2026.

Is there a fix for CVE-2026-77298?

A patch was published on 2026-07-10: Fix committed to master branch (version 4.40) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77298 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-77298?

Check whether you run SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77298: SeaweedFS S3 OIDC Bearer authentication bypasses role trust policy

CVE-2026-77298 · Severity: info · CVSS 7.5 · Published 2026-08-26

SeaweedFS is a distributed storage system used to store files and blobs across multiple servers. In versions 4.39 and earlier, the S3 API can be tricked into granting access to users who should not have it by accepting OIDC authentication tokens directly without checking role permissions. An attacker with a valid OIDC token can bypass security restrictions and gain unauthorized read, write, and delete access to stored objects.

Technologies: SeaweedFS. Vendors: SeaweedFS.

Quick answers

Is CVE-2026-77298 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77298 being exploited in the wild.
How severe is CVE-2026-77298?: Informational severity, with a CVSS score of 7.5, published 26 August 2026.
Which products and versions are affected?: SeaweedFS 4.39 and earlier.
Is there a fix for CVE-2026-77298?: A patch was published on 2026-07-10: Fix committed to master branch (version 4.40) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77298 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-77298?: Check whether you run SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an incorrect authorization vulnerability (CWE-863) in SeaweedFS's S3 API OIDC Bearer token authentication. The S3 API accepts external OIDC JWTs sent in the Authorization: Bearer header and maps them to IAM roles via roleMapping, but fails to enforce the target role's trust policy before issuing the authenticated principal. In contrast, the standard STS AssumeRoleWithWebIdentity path correctly rejects such tokens when the role's trust policy does not trust the OIDC provider. An attacker with a valid OIDC token can bypass the role trust-policy check by presenting the raw JWT directly to the S3 API, causing the system to authenticate as a role they are not permitted to assume and allowing them to execute the role's attached S3 permissions (object read, write, delete). The vulnerability requires a valid OIDC token and network access to the S3 API endpoint. The fix, released in version 4.40, enforces the same trust-policy validation on the S3 bearer path that is used by AssumeRoleWithWebIdentity.

Affected products

SeaweedFS SeaweedFS 4.39 and earlier

Timeline

2026-08-21: disclosed
2026-07-10: patched: Fix committed to master branch (version 4.40)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.