CVE-2026-73080
Received Received - Intake

Remote Code Execution in SeaweedFS VolumeServer

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the response into a needle. The RPC performs no authentication and no target validation, allowing anyone who can reach a volume server's gRPC port to cause requests to arbitrary hosts, including loopback, link-local, RFC 1918, and cloud metadata endpoints such as 169.254.169.254, and read the response. On cloud deployments, this can disclose instance metadata and IAM credentials and reach otherwise unexposed internal services. The volume server gRPC plane is unauthenticated by default, and configuring documented JWT signing keys does not protect this RPC. This issue is fixed in version 4.24.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73080
EUVD
EUVD-2026-56242

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
seaweedfs seaweedfs 4.24
seaweedfs seaweedfs to 4.24 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73080 is a Server-Side Request Forgery (SSRF) vulnerability in SeaweedFS versions before 4.24. The FetchAndWriteNeedle gRPC function allows unauthenticated requests to arbitrary endpoints, including internal, loopback, and cloud metadata services. Attackers can exploit this to read responses from restricted targets, potentially exposing sensitive data like IAM credentials or internal service information.

Detection Guidance

To detect this vulnerability, check if your SeaweedFS volume server is running a version prior to 4.24. Verify if the FetchAndWriteNeedle gRPC endpoint is exposed and unauthenticated. Use network scanning tools to identify if the gRPC port is accessible from untrusted networks. Monitor logs for unusual outbound requests from the volume server to internal or cloud metadata endpoints.

Impact Analysis

This vulnerability allows attackers to make unauthorized requests from your SeaweedFS volume server to internal or external systems. In cloud environments, it could expose instance metadata and IAM credentials. Attackers might also access otherwise unreachable internal services, leading to data breaches or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Exposure of credentials or internal data may result in compliance violations, fines, or legal consequences depending on the data involved.

Mitigation Strategies

Upgrade SeaweedFS to version 4.24 or later to apply the security fixes. Restrict access to the volume server's gRPC port using firewalls or network policies to trusted hosts only. Enable administrative authentication for the FetchAndWriteNeedle RPC. Block outbound requests to loopback, link-local, RFC 1918, and cloud metadata endpoints at the network level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73080. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart