CVE-2026-77368 in SeaweedFS
Summary
by MITRE • 08/27/2026
SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowed_prefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their own token forbids. The HEAD, PATCH, and DELETE verbs that act on an existing session by its id never verify that the session's stored target path falls within the caller's allowed prefixes, so a tenant who obtains another upload's session identifier can PATCH attacker bytes into it and, on completion, have the file land at the victim's out-of-scope path. The same token can also DELETE other tenants' sessions and HEAD them to read upload progress and size, defeating the JWT prefix isolation. This vulnerability only affects deployments that configure filer JWT signing and have TUS uploads enabled. This issue is fixed in version 4.40.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
SeaweedFS version 4.39 contains a critical authorization bypass within its distributed file system's Filer component, specifically affecting the implementation of the TUS resumable upload protocol when combined with JSON Web Token (JWT) based authentication and access control. The vulnerability stems from an inconsistent application of scope validation rules defined by JWT claims, particularly the allowed_prefixes parameter which is intended to restrict tenants to specific directory paths within the storage system. While the initial session creation endpoint correctly validates that the requested upload path falls within the tenant's permitted prefixes, this security check is not enforced for subsequent operations associated with an active upload session. This architectural flaw allows a low-privilege attacker who possesses a valid JWT token to hijack another user's ongoing or completed upload sessions by leveraging the session identifier rather than re-validating the underlying resource path against their own access controls.
The technical mechanism of this exploitation relies on the fact that TUS protocol operations such as HEAD, PATCH, and DELETE are authenticated via the provided JWT but do not perform a secondary authorization check to ensure the target file path aligns with the caller's allowed prefixes. Once an attacker obtains or guesses a valid session ID belonging to another tenant, they can execute a PATCH request to upload malicious content into that session. Because the server trusts the session identifier as proof of ownership without verifying if the original session was created within scopes accessible to the current token, the uploaded data is written directly to the victim's designated path. This effectively bypasses the JWT-based isolation mechanisms, allowing unauthorized writes to restricted areas of the file system. Furthermore, the attacker can utilize HEAD requests to monitor upload progress and size, potentially gathering intelligence on ongoing transfers or confirming successful injection attempts without triggering immediate access denied errors that would occur if they attempted direct write operations outside their scope.
The operational impact of this vulnerability is severe for any deployment utilizing JWT signing with TUS uploads enabled. It results in a complete breakdown of multi-tenant isolation guarantees, enabling data contamination where attackers can overwrite or append to files belonging to other tenants. This compromises the integrity and confidentiality of stored data, as sensitive information may be overwritten by malicious content or exfiltrated through side-channel observations like upload size metrics. In environments where SeaweedFS serves critical business applications or hosts regulated data, this flaw could lead to significant compliance violations and operational disruption. The vulnerability is particularly dangerous because it exploits the trust placed in session identifiers, a common pattern in stateful web services that often overlooks re-validation of resource ownership during intermediate steps of long-running processes like resumable uploads.
To mitigate this risk, organizations must immediately upgrade SeaweedFS to version 4.40 or later, where the developers have implemented consistent authorization checks for all TUS-related HTTP methods against the JWT allowed_prefixes configuration. For deployments that cannot yet upgrade, temporary mitigations include disabling the TUS resumable upload feature if it is not strictly required, thereby removing the attack surface associated with session-based uploads. Additionally, administrators should review their JWT issuance policies to ensure tokens are short-lived and scoped minimally, reducing the window of opportunity for an attacker to exploit a hijacked session identifier. Monitoring logs for unusual patterns in TUS operations, such as repeated PATCH requests on sessions that do not match expected user activity, can also help detect potential exploitation attempts before significant damage occurs. This incident highlights the importance of applying defense-in-depth principles where every state-changing operation must independently verify both authentication and authorization relative to the specific resource being accessed, rather than relying solely on initial session establishment checks.