Listen to this Post
SeaweedFS is a distributed storage system designed for object storage (S3), file systems, and Iceberg tables. In versions 4.08 through 4.33, a critical flaw exists in the authorization handling of the S3Tables and Iceberg REST management API. The root cause lies in how the system processes requests signed with the SigV4 service s3tables.
When such a request is received, SeaweedFS routes it to the S3Tables management API. The vulnerability occurs during the authorization phase on this specific path. The system improperly collapses “account-less” S3 identities—essentially, S3 users who are not explicitly mapped to a specific tenant or account—into a shared, privileged `admin` account. Furthermore, the authorization check “fails open,” meaning that if the identity cannot be properly resolved or authorized, access is granted by default rather than being denied.
As a result, an attacker holding only ordinary S3 Read credentials—with no S3Tables-specific permissions whatsoever—can successfully invoke S3Tables management operations. This includes requests such as GET /buckets, which allows the enumeration of all administrator-owned table bucket inventories, including bucket names and ARNs. The same handler that processes these requests also backs the Iceberg REST catalog, making it vulnerable to the identical flaw. The S3Tables management API was introduced in version 4.08, which marks the starting point for all affected releases.
The vulnerability is officially tracked as CVE-2026-55873 and has been assigned a CVSS v3.1 base score of 4.3 (Medium severity). The attack vector is network-based, requires low privileges, and does not need user interaction. The primary impact is on confidentiality, allowing unauthorized disclosure of sensitive information.
DailyCVE Form:
Platform: SeaweedFS
Version: 4.08–4.33
Vulnerability: Incorrect Authorization
Severity: Medium (CVSS 4.3)
Date: 2026-07-08
Prediction: Patch already available
What Undercode Say:
Analytics
To determine if your SeaweedFS deployment is vulnerable, check the version currently running:
weed version
If the output shows a version between 4.08 and 4.33, the system is affected. To verify the presence of the S3Tables endpoint, look for the service `s3tables` in SigV4-signed requests. The vulnerable code path is triggered when the authorization logic collapses account-less identities into the shared admin account. Administrators should audit logs for unusual `GET /buckets` requests originating from low-privileged S3 users.
Exploit: (Educational Purposes!)
An attacker with valid but low-privileged S3 credentials (e.g., an IAM user with only `s3:GetObject` permissions) can craft a SigV4-signed request targeting the S3Tables management API. The request would be signed with the service name `s3tables` instead of the standard s3. The following is a conceptual example using AWS CLI-style commands (pseudocode):
Assuming AWS credentials for a low-privileged user aws s3api --endpoint-url https://seaweedfs-endpoint \ --service s3tables \ get-buckets
Due to the flawed authorization, the system would process this request as if it originated from the shared admin account, returning the list of all administrator-owned table buckets. The same technique could be used against the Iceberg REST catalog endpoint, which shares the same vulnerable handler.
Protection:
The vulnerability is fully patched in SeaweedFS version 4.34. The fix implements several critical changes:
– Administrator status is now determined by the `ACTION_ADMIN` capability, rather than by a collapsed admin account ID.
– S3Tables authorization no longer defaults to “allow”.
– The tautological `ListTableBuckets` gate, which previously allowed unrestricted access, has been removed.
– Additional hardening measures were applied in pull requests 9962, 9963, and 9971.
No configuration workaround exists. The only effective mitigation is to upgrade to version 4.34 or later immediately.
Impact:
An authenticated low-privileged S3 user can successfully cross the boundary between ordinary S3 object access and the S3Tables management API. The confirmed impact is the unauthorized disclosure of administrator-owned table bucket inventory, including bucket names and ARNs. In shared or multi-tenant deployments, this information leakage can reveal sensitive tenant naming conventions and internal operational structures, providing attackers with valuable intelligence for further targeted attacks. There is no impact on data integrity or availability; the vulnerability is strictly an information disclosure flaw.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
