CVE-2026-58371: SeaweedFS Cross-Site Scripting Vulnerability

CVE-2026-58371 Overview

CVE-2026-58371 affects SeaweedFS versions before 4.30. The vulnerability resides in the shared writeJson helper in weed/server/common.go, which reflects the callback query parameter verbatim into responses served with Content-Type: application/javascript. The helper performs no callback-name validation, sends no X-Content-Type-Options: nosniff header, and enforces no CORS allow-list. Unauthenticated endpoints reachable in the default configuration — including /dir/status, /dir/lookup, /cluster/status, the volume server /status, and the filer directory listing — can be loaded cross-origin through a <script> tag. This exposes cluster topology, volume server URLs, gRPC ports, file identifiers, and directory contents to attacker-controlled web pages.

Critical Impact
Third-party web pages can read SeaweedFS cluster metadata and directory listings cross-origin, and MIME-sniffing clients may interpret the reflected callback as HTML, enabling scripted content injection.

Affected Products

SeaweedFS versions prior to 4.30
Default deployments without -whiteList restrictions
Default deployments without security.toml configured and bound to 0.0.0.0

Discovery Timeline

2026-06-30 - CVE-2026-58371 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-58371

Vulnerability Analysis

The flaw is a cross-origin information disclosure caused by an unsafe JSONP implementation classified as [CWE-79]. The writeJson helper in weed/server/common.go inspects an incoming callback query parameter. When present, the helper switches the response Content-Type to application/javascript and wraps the JSON body as callback(...json...). Because the callback string is user-supplied and unvalidated, attackers can inject arbitrary JavaScript identifiers or characters at the start of the response body. Every endpoint that funnels through writeJson inherits the flaw, including master, volume, and filer routes reachable without authentication in default deployments.

Root Cause

The helper lacks three defensive controls: callback-name validation against a strict character allow-list, an X-Content-Type-Options: nosniff response header, and a CORS allow-list restricting cross-origin loads. Combined, these omissions permit <script src="http://target:9333/dir/status?callback=attackerFn"> to execute in a third-party origin. MIME-sniffing browsers may also treat the reflected prefix as HTML because no nosniff directive is emitted.

Attack Vector

An attacker hosts a malicious web page that references a SeaweedFS master, volume, or filer endpoint via a <script> tag with a chosen callback name. When a victim on an internal network visits the page, the browser issues the cross-origin request and executes the wrapped response. The attacker's callback function receives cluster topology data, volume server URLs and gRPC ports, file identifiers, and directory listings.

// Security patch in weed/server/common.go - writeJson
// Drops the unused JSONP branch entirely (#9686)

-	callback := r.FormValue("callback")
-	if callback == "" {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(httpStatus)
-		if httpStatus == http.StatusNotModified {
-			return
-		}
-		_, err = w.Write(bytes)
-	} else {
-		w.Header().Set("Content-Type", "application/javascript")
-		w.WriteHeader(httpStatus)
-		if httpStatus == http.StatusNotModified {
-			return
-		}
-		if _, err = w.Write([]uint8(callback)); err != nil {
-			return
-		}
-		if _, err = w.Write([]uint8("(")); err != nil {
-			return
-		}
-		fmt.Fprint(w, string(bytes))
-		if _, err = w.Write([]uint8(")")); err != nil {
-			return
-		}
-	}
-
+	w.Header().Set("Content-Type", "application/json")

Source: GitHub Commit 77dcb20. The patch removes the JSONP branch entirely so responses are always served as application/json.

Detection Methods for CVE-2026-58371

Indicators of Compromise

HTTP requests to SeaweedFS endpoints containing a callback= query parameter, particularly against /dir/status, /dir/lookup, /cluster/status, or filer directory paths.
Responses from SeaweedFS with Content-Type: application/javascript where application/json is expected.
Referer headers on SeaweedFS access logs originating from unexpected third-party domains.

Detection Strategies

Inspect reverse-proxy and web server access logs for the callback parameter reaching any SeaweedFS master, volume, or filer port.
Alert on outbound requests from user workstations to internal SeaweedFS ports (typically 9333, 8080, 8888) with script-style loading patterns.
Correlate browser-originated fetches to SeaweedFS endpoints with cross-origin referers.

Monitoring Recommendations

Enable and centralize SeaweedFS HTTP access logging, then baseline expected clients against actual request sources.
Monitor for the presence of Content-Type: application/javascript in SeaweedFS responses as an unambiguous signal of vulnerable versions still serving JSONP.
Track network flows to management endpoints from non-administrative subnets.

How to Mitigate CVE-2026-58371

Immediate Actions Required

Upgrade SeaweedFS to version 4.30 or later, which removes the JSONP branch from writeJson (see the SeaweedFS 4.30 release notes).
Restrict master, volume, and filer HTTP ports to trusted management networks using firewall rules or a reverse proxy.
Configure -whiteList and a security.toml file to require authentication for administrative endpoints.

Patch Information

The fix ships in SeaweedFS 4.30 via pull request #9686 and commit 77dcb20. The patch removes the JSONP callback branch in weed/server/common.go so every response is served as application/json. Additional context is available in the VulnCheck advisory.

Workarounds

Terminate SeaweedFS behind a reverse proxy that strips or rejects requests containing a callback query parameter.
Bind SeaweedFS services to loopback or a private management interface instead of 0.0.0.0.
Inject X-Content-Type-Options: nosniff and a strict CORS policy at the reverse-proxy layer to blunt MIME-sniffing and cross-origin script loads.

bash

# Example NGINX rule to block callback query parameters upstream of SeaweedFS
location / {
    if ($arg_callback) {
        return 400;
    }
    add_header X-Content-Type-Options "nosniff" always;
    proxy_pass http://127.0.0.1:9333;
}