CVE-2026-72921 in SeaweedFS
Summary
by MITRE • 08/11/2026
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
SeaweedFS represents a distributed storage system designed to provide scalable and reliable data management capabilities across multiple nodes. The vulnerability under examination stems from an authorization flaw within the filer server component that affects versions prior to 4.24. This issue specifically impacts how path-based access control is enforced when processing JWT tokens for scoped permissions. The root cause lies in the implementation of authorization checks that utilize strings.HasPrefix function against raw path strings without proper boundary validation, creating a critical security gap in tenant isolation mechanisms.
The technical flaw manifests through improper path matching logic where the authorization system fails to distinguish between exact path matches and partial prefix matches. When a JWT token is scoped to a specific tenant path such as /tenant1, the flawed implementation allows access to any path that begins with the same prefix regardless of whether it represents a legitimate sibling path or a separate tenant namespace. This means that a token authorized for /tenant1 could inadvertently grant access to /tenant1234, /tenant1-old, and /tenant1backup due to the prefix matching behavior. The vulnerability fundamentally undermines the principle of least privilege by enabling unauthorized cross-tenant data access through valid authentication tokens.
The operational impact of this vulnerability extends beyond simple information disclosure to encompass potential data integrity violations and unauthorized modifications across tenant boundaries. Attackers could leverage this flaw to read or write data in neighboring tenant namespaces, effectively bypassing the multi-tenancy isolation that SeaweedFS is designed to provide. This cross-tenant access capability creates significant risks for organizations relying on SeaweedFS for secure multi-tenant deployments where data separation is critical for compliance and security requirements. The vulnerability essentially transforms scoped authorization into a broad permission model, undermining the entire security architecture of the system.
The fix implemented in version 4.24 addresses this issue by correcting the path validation logic to ensure proper boundary checking before granting access permissions. This remediation aligns with established security principles that require precise matching of authorization scopes to prevent privilege escalation through prefix-based attacks. Organizations should prioritize upgrading to version 4.24 or later to mitigate this vulnerability, while also implementing additional monitoring to detect any unauthorized access attempts that may have occurred prior to the fix. The resolution demonstrates the importance of proper input validation and boundary checking in authorization systems, particularly when dealing with hierarchical path structures where prefix matching can introduce unexpected security implications.
This vulnerability type corresponds to CWE-285: Improper Authorization within the Common Weakness Enumeration framework, specifically addressing issues related to insufficient access control mechanisms. From an ATT&CK perspective, this flaw maps to T1078: Valid Accounts and T1566: Phishing, as it enables attackers to leverage valid JWT tokens for unauthorized access while potentially requiring initial reconnaissance to identify the scope of affected paths. The security implications highlight the critical need for robust path validation in distributed systems where multiple tenants share the same infrastructure and where authorization boundaries must be strictly enforced to prevent data leakage and cross-tenant interference.