CVE-2026-72920: SeaweedFS Auth Bypass Vulnerability

CVE-2026-72920 Overview

CVE-2026-72920 is a missing authentication vulnerability [CWE-306] in SeaweedFS, a distributed storage system. Versions prior to 4.24 register the SeaweedIdentityAccessManagement gRPC service on the filer without mandatory authentication when jwt.filer_signing.key is unset. Any client that can reach the filer gRPC port can invoke IAM remote procedure calls including CreateUser, CreateAccessKey, and PutPolicy to mint credentials and obtain S3 administrative control. The issue is fixed in version 4.24.

Critical Impact
Unauthenticated network attackers with access to the filer gRPC port can mint arbitrary S3 credentials and take administrative control of the SeaweedFS deployment.

Affected Products

SeaweedFS versions prior to 4.24
SeaweedFS filer component exposing the IAM gRPC service
Deployments where jwt.filer_signing.key is unset in security.toml

Discovery Timeline

2026-08-11 - CVE-2026-72920 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72920

Vulnerability Analysis

The SeaweedFS filer registers the SeaweedIdentityAccessManagement gRPC service whenever a credential manager is configured. The registration path did not verify that an administrative signing key existed before mounting the service. As a result, the IAM RPCs were exposed on an unauthenticated listener.

The IAM service exposes credential and policy management operations. An attacker with network reach to the filer gRPC port can call CreateUser to add identities, CreateAccessKey to mint S3 access keys, and PutPolicy to assign administrative permissions. These operations grant full S3 administrative control over the storage cluster.

Root Cause

The root cause is missing authentication on a sensitive gRPC service [CWE-306]. The filer initialization code in weed/command/filer.go unconditionally registered iam_pb.RegisterSeaweedIdentityAccessManagementServer when a credential manager was present. No check verified that jwt.filer_signing.key was configured, so any operator running the filer with default security.toml settings exposed the IAM plane without a Bearer token requirement.

Attack Vector

Exploitation requires network access to the filer gRPC port. No credentials, user interaction, or prior privileges are required. An attacker sends gRPC calls directly to the IAM service to create users, generate access keys, and assign administrative policies. The minted credentials then provide persistent S3 administrative access to buckets and objects.

	grpcS := pb.NewGrpcServer(security.LoadServerTLS(util.GetViper(), "grpc.filer"))
	filer_pb.RegisterSeaweedFilerServer(grpcS, fs)

-	// Register IAM gRPC service if credential manager is available
+	// Register IAM gRPC service only when both a credential manager and an
+	// admin signing key are configured. The IAM RPCs can create users and
+	// mint access keys; mounting them on an unauthenticated listener would
+	// hand any caller that can reach the gRPC port S3-admin equivalent power.
	if credentialManager != nil {
-		iamGrpcServer := weed_server.NewIamGrpcServer(credentialManager)
-		iam_pb.RegisterSeaweedIdentityAccessManagementServer(grpcS, iamGrpcServer)
-		glog.V(0).Info("Registered IAM gRPC service on filer")
+		adminSigningKey := security.SigningKey(util.GetViper().GetString("jwt.filer_signing.key"))
+		if len(adminSigningKey) == 0 {
+			glog.Warningf("IAM gRPC service NOT registered on filer: jwt.filer_signing.key is empty in security.toml; configure it to enable IAM administration")
+		} else {
+			iamGrpcServer := weed_server.NewIamGrpcServer(credentialManager, adminSigningKey)
+			iam_pb.RegisterSeaweedIdentityAccessManagementServer(grpcS, iamGrpcServer)
+			glog.V(0).Info("Registered IAM gRPC service on filer (admin Bearer token required)")
+		}
	}

Source: GitHub Commit 5e8f99f

Detection Methods for CVE-2026-72920

Indicators of Compromise

Unexpected CreateUser, CreateAccessKey, or PutPolicy calls in filer gRPC logs
New S3 identities or access keys that do not correspond to authorized administrative activity
Policy attachments granting admin or wildcard permissions to unfamiliar users
Access to the filer gRPC port from unexpected source addresses

Detection Strategies

Audit the SeaweedFS credential store for user accounts and access keys not created by legitimate administrators
Inspect filer logs for the absence of the warning IAM gRPC service NOT registered on filer on patched builds, which confirms the safe path
Correlate S3 API activity with issuance timestamps of access keys to identify credentials minted outside change-management windows

Monitoring Recommendations

Monitor network flows to the filer gRPC port and restrict them to known administrative hosts
Alert on gRPC calls to SeaweedIdentityAccessManagement methods from non-administrative sources
Track creation of S3 policies with elevated permissions and review them against approved change tickets

How to Mitigate CVE-2026-72920

Immediate Actions Required

Upgrade SeaweedFS to version 4.24 or later
Configure jwt.filer_signing.key in security.toml to enable authenticated IAM administration
Rotate all existing S3 access keys and audit user accounts created before the upgrade
Restrict network access to the filer gRPC port to trusted administrative hosts only

Patch Information

The fix is available in SeaweedFS Release 4.24 and was merged via Pull Request #9442. Full details are documented in GitHub Security Advisory GHSA-2v6v-25fm-p4fg. The patch refuses to register the IAM gRPC service when jwt.filer_signing.key is empty, and every IAM RPC must carry a Bearer token signed with that key in its authorization gRPC metadata.

Workarounds

Block external network access to the filer gRPC port using firewall rules or network policies
If upgrading is not immediately possible, disable the credential manager to prevent IAM service registration
Place the filer behind an authenticated reverse proxy that enforces mutual TLS on gRPC traffic

bash

# security.toml - required configuration on patched builds
[jwt.filer_signing]
key = "<generate a strong signing key here>"

# Mint an admin Bearer token with security.GenJwtForFilerAdmin
# and attach it in the "authorization" gRPC metadata on every IAM call.