CVE-2026-77368

Received Received - Intake

JWT Session Hijacking in SeaweedFS TUS Upload

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowed_prefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their own token forbids. The HEAD, PATCH, and DELETE verbs that act on an existing session by its id never verify that the session's stored target path falls within the caller's allowed prefixes, so a tenant who obtains another upload's session identifier can PATCH attacker bytes into it and, on completion, have the file land at the victim's out-of-scope path. The same token can also DELETE other tenants' sessions and HEAD them to read upload progress and size, defeating the JWT prefix isolation. This vulnerability only affects deployments that configure filer JWT signing and have TUS uploads enabled. This issue is fixed in version 4.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-77368

Affected Vendors & Products

Vendor	Product	Version / Range
seaweedfs	seaweedfs	to 4.40 (exc)
seaweedfs	seaweedfs	4.40

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in SeaweedFS 4.39 allows a low-privilege user to hijack another user's file upload session. The system checks JWT permissions only when a session starts, not during ongoing operations like PATCH, DELETE, or HEAD requests. An attacker can use another user's session ID to upload files to unauthorized paths or delete their sessions.

Detection Guidance

This vulnerability can be detected by checking SeaweedFS version and TUS upload configurations. Verify if your system runs version 4.39 or earlier with TUS enabled and JWT signing configured. Inspect filer logs for unusual upload sessions or unauthorized file writes.

Impact Analysis

If exploited, this flaw could let an attacker write files to restricted directories, bypassing access controls. They could also delete or monitor other users' upload sessions, potentially stealing sensitive data or disrupting legitimate uploads. Only systems using filer JWT signing and TUS uploads are affected.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. It undermines access controls and audit trails, potentially resulting in non-compliance and legal penalties for affected organizations.

Mitigation Strategies

Upgrade SeaweedFS to version 4.40 or later to address the JWT prefix isolation bypass in TUS resumable-upload handler.

Hi! I’m here to help you understand CVE-2026-77368. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70