Vulnerability Description
SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey, PutPolicy, and related IAM RPCs to mint credentials and gain S3 administrative control. This issue is fixed in versions 4.24.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/seaweedfs/seaweedfs/commit/5e8f99f40a8abc7b449aefd26051644337
- https://github.com/seaweedfs/seaweedfs/pull/9442
- https://github.com/seaweedfs/seaweedfs/releases/tag/4.24
- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-2v6v-25fm-p4fg
FAQ
What is CVE-2026-72920?
CVE-2026-72920 is a vulnerability with a CVSS score of 9.8 (CRITICAL). SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, all...
How severe is CVE-2026-72920?
CVE-2026-72920 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-72920?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.