CVE-2026-72921 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
Attackers with a scoped JWT can access sibling tenant paths due to flawed prefix matching, enabling cross-tenant data access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72921?
CVE-2026-72921 is a high-severity authentication bypass vulnerability in seaweedfs, published on 11 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.
Weakness: CWE-863
Which versions are affected by CVE-2026-72921?
4 open source packages ship an affected version, including github.com/seaweedfs/seaweedfs and seaweedfs.
| Package | Affected | Fixed in |
|---|---|---|
github.com/seaweedfs/seaweedfs Go | All versions | 0.0.0-20260512171048-05ed5c9ae8a2 |
github.com/seaweedfs/seaweedfs Go | All versions | 0.0.0-20260512171048-05ed5c9ae8a2 |
github.com/seaweedfs/seaweedfs Go | All versions | 0.0.0-20260512171048-05ed5c9ae8a2 |
seaweedfs Bitnami | All versions | 4.24.0 |
How do I fix CVE-2026-72921?
Upgrade github.com/seaweedfs/seaweedfs to 0.0.0-20260512171048-05ed5c9ae8a2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-72921 being exploited?
There is no known exploitation of CVE-2026-72921 in the wild and no public exploit code.
Sources
Also known as BIT-seaweedfs-2026-72921, GHSA-gv5w-hfx8-8cwq, GO-2026-6361, MINI-47cq-q2wm-xq4m, MINI-fmfq-w4w4-jp9c.