External risk intelligence

SeaweedFS IAM Service Credential Minting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72920

SeaweedFS is a distributed storage system where the filer gRPC service is typically intended for internal communication between cluster components or administrative tools. While it is network-reachable and could be exposed in misconfigured deployments, it is not standard practice to expose gRPC-based storage management interfaces directly to the public internet.

Missing Authentication

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in SeaweedFS, a distributed storage system, that could allow unauthorized access to administrative controls. If not properly secured, an attacker could potentially mint credentials and gain administrative control over the S3 storage, impacting data confidentiality, integrity, and availability. The primary concern is confirming if this specific technology is in use and exposed within our environment.

Unauthenticated access to storage administrative controls.
Potential for unauthorized credential minting and S3 control.
Confirm relevance and exposure in our environment.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this by reaching the SeaweedFS filer's gRPC port, which is accessible over the network without authentication if a specific security setting is not configured. This allows them to invoke commands to create users and access keys, ultimately granting them administrative control over the S3 storage.

Network access to filer gRPC port needed.
Unauthenticated IAM RPC calls trigger vulnerability.
Gain administrative S3 control.

Live Threat

Current exploitation, exposure, and threat context

When the SeaweedFS filer's identity and access management service is not secured with a signing key, any client that can reach the filer's gRPC port could invoke administrative functions to create users, issue access keys, and set policies. This could allow an unauthenticated attacker to gain S3 administrative control over the storage system.

Filer administrative control at risk.
Unauthenticated RPC invocation.
Gaining S3 administrative control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The platform or infrastructure team managing SeaweedFS deployments is likely responsible for addressing this vulnerability. The initial step involves identifying all instances of SeaweedFS, particularly the filer component, and determining their network exposure. Confirming reachability from untrusted networks and assessing business criticality will guide prioritization, followed by engaging the system owner to plan a remediation strategy, which may involve vendor coordination or controlled updates.

Platform/Infrastructure teams own the issue.
Verify external reachability of filer gRPC.
Plan controlled updates or configuration hardening.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SeaweedFS and why is the filer component important?

SeaweedFS is a distributed storage system used to store and manage large amounts of data, often acting as a scalable object store. The filer component serves as the metadata management layer, handling file hierarchies and coordinating access. Because it manages the namespace and security policies, it acts as the brain of the storage cluster, making its configuration critical to overall system integrity.

What does CWE-306 mean in the context of CVE-2026-72920?

CWE-306 refers to a Missing Authentication for Critical Function. For this CVE, it means the SeaweedFS filer fails to verify the identity of users attempting to perform sensitive administrative actions. Specifically, the system allows callers to invoke identity management functions—like creating users or generating access keys—without proving who they are, which bypasses the intended security gate for S3 administrative control.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending unauthorized requests to the filer's gRPC port. This only succeeds when the 'jwt.filer_signing.key' configuration is unset, leaving the service without a mandatory authentication requirement. Simply having network access is not enough if this signing key is properly configured; the vulnerability remains dormant if the identity and access management service is secured with a valid key.

Is my environment at risk of CVE-2026-72920?

Halo Surface Signal notes that while the filer gRPC service is typically meant for internal cluster communication, misconfigurations can inadvertently make it reachable from broader networks. You should prioritize assessing instances where the filer port is accessible outside of its intended internal management scope, as increased network reachability directly correlates with the potential for unauthorized access to your S3 storage administrative functions.

What steps should I take if I am running SeaweedFS?

Start by identifying all deployed SeaweedFS filer instances in your infrastructure. Verify if the 'jwt.filer_signing.key' is currently configured to enforce authentication. If you are running a version prior to 4.24, coordinate with your infrastructure team to plan an update to version 4.24 or higher, which resolves the underlying authentication weakness, while simultaneously ensuring the gRPC port is restricted to trusted internal networks.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.