CVE-2026-55873: SeaweedFS Auth Bypass Vulnerability

CVE-2026-55873 Overview

CVE-2026-55873 is a broken access control vulnerability in SeaweedFS, an open-source distributed storage system. Versions 4.08 through 4.33 route requests signed with SigV4 service s3tables to the S3Tables management API. In that path, authorization collapses account-less S3 identities into a shared admin account and fails open. An authenticated low-privileged S3 user can enumerate administrator-owned table bucket names and Amazon Resource Names (ARNs). The issue maps to [CWE-863: Incorrect Authorization] and is fixed in version 4.34.

Critical Impact
Authenticated low-privileged S3 users can enumerate administrator-owned table bucket names and ARNs by exploiting the S3Tables management API authorization bypass.

Affected Products

SeaweedFS versions 4.08 through 4.33
SeaweedFS S3 API gateway with S3Tables management enabled
SeaweedFS Iceberg REST Catalog server component

Discovery Timeline

2026-07-08 - CVE-2026-55873 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55873

Vulnerability Analysis

SeaweedFS supports S3-compatible operations, including the newer S3Tables management API used by Apache Iceberg workloads. Clients sign requests with AWS Signature Version 4 (SigV4). When a request specifies the s3tables service in its SigV4 credential scope, SeaweedFS routes it to the S3Tables management handler.

The handler treats account-less S3 identities as the shared admin account. It also fails open when the full identity struct does not reach the handler. A low-privileged authenticated S3 user can therefore invoke management APIs reserved for administrators. The attacker gains read visibility into administrator-owned table bucket names and ARNs, enabling reconnaissance for further attacks against Iceberg catalogs.

Root Cause

The root cause is incorrect authorization in the S3Tables Iceberg REST Catalog server. The defaultAllow behavior intended for zero-configuration deployments applied even when an authenticator was configured. Account-less identities were normalized to the admin account rather than being rejected or scoped to the caller's actual permissions.

Attack Vector

An authenticated low-privileged S3 user sends a SigV4-signed request with service set to s3tables against the SeaweedFS gateway. Because the handler does not enforce the caller's identity, the request is processed with elevated privileges. No user interaction is required and the vector is network-reachable.

 // NewServer creates a new Iceberg REST Catalog server.
 func NewServer(filerClient FilerClient, authenticator S3Authenticator) *Server {
 	manager := s3tables.NewManager()
+	// Mirror the S3 port: fall open by default only when the gateway itself is
+	// open. With auth configured, an authenticated catalog caller must pass the
+	// normal permission check instead of being allowed because no policy denied
+	// it — even if the full identity struct ever fails to reach the handler.
+	if authenticator != nil {
+		manager.SetDefaultAllow(authenticator.DefaultAllow())
+	}
 	return &Server{
 		filerClient:   filerClient,
 		tablesManager: manager,

Source: SeaweedFS commit b1346388. The patch scopes management authorization to the caller's identity and only allows default-allow behavior when the S3 gateway is itself open.

Detection Methods for CVE-2026-55873

Indicators of Compromise

SigV4-signed requests to the SeaweedFS S3 endpoint where the credential scope contains the s3tables service string from non-administrative principals.
Access log entries showing S3Tables management API calls (ListTableBuckets, GetTableBucket) originating from account-less or low-privileged identities.
Unexpected enumeration patterns of table bucket names and ARNs by non-admin users.

Detection Strategies

Inspect SeaweedFS gateway logs for requests with X-Amz-Credential values referencing /s3tables/ scope issued by non-admin access keys.
Correlate authenticated S3 API access with the identity's IAM policy to flag callers exercising management endpoints they should not reach.
Alert on repeated 200 OK responses to S3Tables management endpoints from principals that lack an explicit s3tables:* allow.

Monitoring Recommendations

Enable verbose S3 API audit logging on all SeaweedFS filer and S3 gateway nodes running versions 4.08 through 4.33.
Forward gateway logs to a SIEM and build detections for the s3tables service scope combined with low-privileged access keys.
Track privileged API calls (bucket enumeration, ARN listing) and baseline expected admin-only sources.

How to Mitigate CVE-2026-55873

Immediate Actions Required

Upgrade SeaweedFS to version 4.34 or later, which contains the fix from pull request #9961.
Rotate any S3 access keys that may have been used to enumerate administrator-owned table buckets during the exposure window.
Review S3 IAM policies to confirm the principle of least privilege is enforced for all non-admin identities.

Patch Information

The fix is available in the SeaweedFS 4.34 release. Full technical details are documented in GitHub Security Advisory GHSA-hgpf-8634-g44c. The patch scopes management authorization to the caller's identity and only preserves default-allow behavior when the gateway itself is configured without authentication.

Workarounds

Disable the S3Tables Iceberg REST Catalog endpoint if it is not in use until upgrading to 4.34.
Restrict network access to the SeaweedFS S3 gateway using firewall rules so that only trusted client subnets can send s3tables service requests.
Ensure all S3 identities are configured with explicit account IDs to prevent collapse into the shared admin account.

bash

# Verify SeaweedFS version and upgrade
weed version
# Upgrade to 4.34 (example using release binary)
wget https://github.com/seaweedfs/seaweedfs/releases/download/4.34/linux_amd64.tar.gz
tar -xzf linux_amd64.tar.gz
sudo mv weed /usr/local/bin/weed
weed version