# CVE-2026-77298: SeaweedFS S3 OIDC Bearer authentication bypasses role trust policy

Source: https://junglewise.ai/threats/cve-2026-77298-seaweedfs-s3-oidc-bearer-authentication-bypasses-role-trust  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77298 · Severity: info · CVSS 7.5 · Published 2026-08-26

SeaweedFS is a distributed storage system used to store files and blobs across multiple servers. In versions 4.39 and earlier, the S3 API can be tricked into granting access to users who should not have it by accepting OIDC authentication tokens directly without checking role permissions. An attacker with a valid OIDC token can bypass security restrictions and gain unauthorized read, write, and delete access to stored objects.

Technologies: [SeaweedFS](https://junglewise.ai/threats/technologies/seaweedfs). Vendors: [SeaweedFS](https://junglewise.ai/threats/vendors/seaweedfs).

## Quick answers

**Is CVE-2026-77298 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77298 being exploited in the wild.

**How severe is CVE-2026-77298?** Informational severity, with a CVSS score of 7.5, published 26 August 2026.

**Which products and versions are affected?** SeaweedFS 4.39 and earlier.

**Is there a fix for CVE-2026-77298?** A patch was published on 2026-07-10: Fix committed to master branch (version 4.40) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77298 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-77298?** Check whether you run SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an incorrect authorization vulnerability (CWE-863) in SeaweedFS's S3 API OIDC Bearer token authentication. The S3 API accepts external OIDC JWTs sent in the Authorization: Bearer header and maps them to IAM roles via roleMapping, but fails to enforce the target role's trust policy before issuing the authenticated principal. In contrast, the standard STS AssumeRoleWithWebIdentity path correctly rejects such tokens when the role's trust policy does not trust the OIDC provider. An attacker with a valid OIDC token can bypass the role trust-policy check by presenting the raw JWT directly to the S3 API, causing the system to authenticate as a role they are not permitted to assume and allowing them to execute the role's attached S3 permissions (object read, write, delete). The vulnerability requires a valid OIDC token and network access to the S3 API endpoint. The fix, released in version 4.40, enforces the same trust-policy validation on the S3 bearer path that is used by AssumeRoleWithWebIdentity.

## Affected products

- SeaweedFS SeaweedFS 4.39 and earlier

## Timeline

- 2026-08-21: disclosed
- 2026-07-10: patched: Fix committed to master branch (version 4.40)

## References

- [https://github.com/seaweedfs/seaweedfs/commit/ac524e140a37242b2488be9dfffae918da1d4de1](https://github.com/seaweedfs/seaweedfs/commit/ac524e140a37242b2488be9dfffae918da1d4de1)
- [https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-757h-cm9x-wprg](https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-757h-cm9x-wprg)

## Related threats

- [SeaweedFS SFTP Helm chart hardcoded Ed25519 host key](https://junglewise.ai/threats/cve-2026-100413-seaweedfs-is-a-distributed-storage-system-for-files-and-blobs)
- [SeaweedFS unauthenticated filer IAM gRPC service authentication bypass](https://junglewise.ai/threats/cve-2026-72920-seaweedfs-unauthenticated-filer-iam-grpc-service-authentication)
- [SeaweedFS S3 object-scope bypass in PutObjectAcl](https://junglewise.ai/threats/cve-2026-77611-seaweedfs-s3-object-scope-bypass-in-putobjectacl)
- [SeaweedFS TUS resumable-upload JWT authorization bypass](https://junglewise.ai/threats/cve-2026-77368-seaweedfs-tus-resumable-upload-jwt-authorization-bypass)
- [SeaweedFS SFTP path ACL literal prefix matching bypass](https://junglewise.ai/threats/cve-2026-77317-seaweedfs-sftp-path-acl-literal-prefix-matching-bypass)