Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-72920
9.8 CRITICAL
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control
SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey, PutPolicy, and related IAM RPCs to mint credentials and gain S3 administrative control. This issue is fixed in versions 4.24.
References
-
https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-2v6v-25fm-p4fg x_refsource_CONFIRM
-
https://github.com/seaweedfs/seaweedfs/pull/9442 x_refsource_MISC
-
https://github.com/seaweedfs/seaweedfs/releases/tag/4.24 x_refsource_MISC
Affected products
seaweedfs
- ==< 4.24
Package maintainers
-
@wozeparrot Woze Parrot <wozeparrot@gmail.com>
-
@azahi Azat Bahawi <azat@bahawi.net>
-
@cmacrae Calum MacRae <hi@cmacr.ae>