CVE-2026-77298

Received Received - Intake

Privilege Escalation via OIDC JWT in SeaweedFS S3 API

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federated user can assume a role they are not permitted to hold. The standard STS AssumeRoleWithWebIdentity path rejects such a token when the role's trust policy does not trust the token's federated provider, but the direct S3 bearer path validates only the token itself and then authenticates as the mapped role and evaluates that role's attached S3 permissions. As a result, a valid OIDC user whose token would be denied the role through STS can obtain the role's S3 access, including object read, write, and delete, by presenting the raw OIDC JWT directly to the S3 API. This issue is fixed in version 4.40

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-77298

Affected Vendors & Products

Vendor	Product	Version / Range
seaweedfs	seaweedfs	to 4.40 (exc)
seaweedfs	seaweedfs	4.40

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

SeaweedFS versions 4.39 and earlier have a flaw in the S3 API where an external OIDC JWT can be sent directly in the Authorization header. This token is mapped to an IAM role without checking if the role's trust policy allows the federated user to assume it. The system validates only the token itself, not the role's trust policy, allowing unauthorized access to the role's S3 permissions.

Detection Guidance

Detecting this vulnerability requires checking if SeaweedFS versions 4.39 or earlier are running and if S3 API endpoints improperly accept raw OIDC JWTs without validating role trust policies. Inspect SeaweedFS logs for S3 API requests with Authorization headers containing JWT tokens. Verify SeaweedFS version using commands like 'weed version' or 'curl http://localhost:9333/status'. Monitor for unauthorized S3 operations such as object reads, writes, or deletes by users who should not have access.

Impact Analysis

This vulnerability allows a valid OIDC user to gain unauthorized access to an IAM role's S3 permissions, including read, write, and delete operations. This could lead to data theft, unauthorized modifications, or deletion of files and blobs stored in SeaweedFS.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements for GDPR, HIPAA, and other regulations. It undermines data integrity, confidentiality, and access control measures required by these standards.

Mitigation Strategies

Upgrade SeaweedFS to version 4.40 or later to address the vulnerability. Ensure the S3 API no longer accepts raw OIDC JWTs without proper STS validation.

Hi! I’m here to help you understand CVE-2026-77298. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70