CVE-2026-100413

Awaiting Analysis Awaiting Analysis - Queue

Hard-Coded Ed25519 Private Key in SeaweedFS SFTP Helm Chart

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfs_sftp_ssh_private_key. A standalone deployment presented that public key when sftp.enabled and sftp.enableAuth were true, sftp.existingConfigSecret was not supplied, the legacy sftp.sshPrivateKey path remained selected, a valid config-ssh Secret allowed startup, and hostKeysFolder did not provide a later Ed25519 signer. An attacker able to redirect or intercept client traffic could impersonate that SFTP endpoint to clients that trusted the published host identity, exposing password credentials or data sent to the rogue endpoint. Default all-in-one and non-authenticated standalone paths did not load the key. This issue is fixed in version 4.41.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100413

EUVD

EUVD-2026-101519

Affected Vendors & Products

Vendor	Product	Version / Range
seaweedfs	seaweedfs	>= 4.0.388, < 4.41

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

CVE-2026-100413 is a vulnerability in SeaweedFS's SFTP Helm chart where a fixed, unencrypted Ed25519 private host key was embedded in the chart. This caused all affected deployments to present the same host identity unless manually overridden. Attackers could exploit this to impersonate the SFTP server and intercept client traffic.

Detection Guidance

Check if your SeaweedFS SFTP deployment is using the hard-coded Ed25519 host key by inspecting the fingerprint SHA256:0afw5vH6NIGPGe3H+d9x8M3QoVZyGZZem58XuawSMj0. Use commands like 'ssh-keygen -lf /path/to/key' to verify the fingerprint of the host key presented by your SFTP server.

Impact Analysis

If your SeaweedFS SFTP deployment meets specific configuration conditions, an attacker could impersonate the SFTP endpoint. This may expose SFTP credentials or data sent to the rogue server. Password-authenticated sessions are at risk, but public-key authentication signatures cannot be replayed.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by exposing SFTP credentials and data in transit due to the use of a hard-coded host key. Attackers could impersonate the SFTP endpoint, leading to unauthorized access to sensitive data, which violates confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade to SeaweedFS version 4.41 or later to ensure per-install host key generation. If upgrading is not immediately possible, manually generate a unique Ed25519 host key and configure the SFTP deployment to use it instead of the bundled key.

Hi! I’m here to help you understand CVE-2026-100413. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70