CVE-2026-72920 SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control
Attackers can gain S3 administrative control by invoking unauthenticated IAM gRPC services when JWT signing keys are not configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72920?
CVE-2026-72920 is a critical missing authorization vulnerability in seaweedfs, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey, PutPolicy, and related IAM RPCs to mint credentials and gain S3 administrative control. This issue is fixed in versions 4.24.
Weakness: CWE-306
Which versions are affected by CVE-2026-72920?
4 open source packages ship an affected version, including github.com/seaweedfs/seaweedfs and seaweedfs.
| Package | Affected | Fixed in |
|---|---|---|
github.com/seaweedfs/seaweedfs Go | All versions | 0.0.0-20260512171108-5e8f99f40a8a |
github.com/seaweedfs/seaweedfs Go | All versions | 0.0.0-20260512171108-5e8f99f40a8a |
github.com/seaweedfs/seaweedfs Go | All versions | 0.0.0-20260512171108-5e8f99f40a8a |
seaweedfs Bitnami | All versions | 4.24.0 |
How do I fix CVE-2026-72920?
Upgrade github.com/seaweedfs/seaweedfs to 0.0.0-20260512171108-5e8f99f40a8a or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-72920 being exploited?
There is no known exploitation of CVE-2026-72920 in the wild and no public exploit code.
Sources
Also known as BIT-seaweedfs-2026-72920, GHSA-2v6v-25fm-p4fg, GO-2026-6351, MINI-24w3-9649-75j4, MINI-qcv7-976x-rw6h.