Authentication Bypass in SeaweedFS via Unprotected gRPC IAM Service

Executive Summary

CVE-2026-72920 is a critical vulnerability in SeaweedFS versions prior to 4.24 where the filer's IAM gRPC service operates without mandatory authentication when the JWT signing key is unset. This allows any client with access to the gRPC port to invoke administrative functions like creating users, access keys, or policies, granting full S3 administrative control.

Useful 0 Not Useful 0

Detection Guidance

Check if the SeaweedFS filer gRPC port is exposed to untrusted networks. Use commands like 'netstat -tulnp | grep <gRPC_port>' or 'ss -tulnp | grep <gRPC_port>' to verify port exposure. Inspect SeaweedFS logs for unauthorized IAM gRPC calls or unusual credential creation events.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized administrative access to the SeaweedFS S3 storage system. This includes creating fake users, modifying access permissions, deleting or altering stored data, and potentially taking full control of the system without any credentials.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating confidentiality and integrity requirements under GDPR and HIPAA. Non-compliance may result in legal penalties, data breach notifications, and reputational damage due to loss of protected health or personal information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SeaweedFS to version 4.24 or later. If upgrading is not immediately possible, restrict access to the filer gRPC port using firewalls or network policies. Configure the JWT signing key in security.toml to enforce authentication for IAM gRPC services.

Useful 0 Not Useful 0