CVE-2026-72921: SeaweedFS Auth Bypass Vulnerability

CVE-2026-72921 Overview

CVE-2026-72921 is an authorization flaw in SeaweedFS, a distributed storage system, affecting all versions prior to 4.24. The filer server's allowed_prefixes authorization check used strings.HasPrefix on raw path strings without enforcing path component boundaries. A JSON Web Token (JWT) scoped to /tenant1 therefore also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup. Attackers holding a valid but narrowly scoped token can read and write objects belonging to other tenants. The issue is fixed in SeaweedFS version 4.24. The vulnerability is tracked as CWE-863: Incorrect Authorization.

Critical Impact
Any authenticated tenant with a scoped filer JWT can perform cross-tenant reads and writes against sibling paths sharing the same prefix string, breaking multi-tenant isolation.

Affected Products

SeaweedFS filer server (weed/server/filer_server_handlers.go) — all versions prior to 4.24
Deployments relying on JWT allowed_prefixes for multi-tenant path isolation
Any SeaweedFS filer configuration issuing tokens scoped to sibling tenant paths

Discovery Timeline

2026-08-11 - CVE-2026-72921 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72921

Vulnerability Analysis

SeaweedFS filer endpoints validate incoming JWTs against a list of allowed_prefixes that constrain which paths a token can access. The pre-4.24 implementation compared the requested path to each allowed prefix using strings.HasPrefix, a byte-level string comparison. This comparison does not consider path separators, so /tenant1 matched not only /tenant1/... but any path beginning with the literal characters tenant1. An attacker with a token intended for a single tenant could issue GET, PUT, or DELETE requests against unrelated tenant directories that shared the prefix, undermining tenant isolation across the filer namespace.

Root Cause

The root cause is a lexical prefix check used to enforce a hierarchical authorization decision. Path-based access control requires component-aware matching so that /tenant1 does not authorize /tenant1234. The fix in commit 05ed5c9 imports Go's path package and scopes prefix matching to path components, ensuring the trailing character of an allowed prefix is either the end of the path or a / separator.

Attack Vector

Exploitation requires a valid filer JWT scoped to at least one prefix. The attacker crafts HTTP requests targeting sibling paths whose names begin with the authorized prefix string. No user interaction is needed and the attack traverses the network to the filer endpoint. Successful requests return or overwrite data owned by other tenants.

// Security patch in weed/server/filer_server_handlers.go
// filer: scope JWT allowed_prefixes to path components (#9439)
 	"context"
 	"errors"
 	"net/http"
+	"path"
 	"strconv"
 	"strings"
 	"sync/atomic"

Source: GitHub commit 05ed5c9. The patch introduces the path package so authorization checks operate on path components rather than raw string prefixes.

Detection Methods for CVE-2026-72921

Indicators of Compromise

Filer access logs showing a single JWT subject issuing requests against multiple tenant directories that share a leading substring.
Successful HTTP 200 or 204 responses for PUT, POST, or DELETE operations on paths outside a tenant's provisioned namespace.
Object listings or reads from directories such as /tenant1234 or /tenant1-old performed by tokens provisioned for /tenant1.

Detection Strategies

Compare the sub or tenant claim in filer JWTs against the actual path component accessed in each request, and alert when the top-level directory differs.
Baseline per-token access patterns to the filer and flag deviations that touch previously unseen tenant roots.
Review historical filer access logs for prefix-collision access dating back to the deployment of any pre-4.24 filer.

Monitoring Recommendations

Ship filer HTTP access logs to a central analytics store and enrich them with the decoded JWT claims for correlation.
Alert on write operations against tenant paths not enumerated in the requester's authorization scope.
Track SeaweedFS version metadata from filer /status endpoints to identify hosts still running vulnerable builds.

How to Mitigate CVE-2026-72921

Immediate Actions Required

Upgrade all SeaweedFS filer instances to version 4.24 or later, published in the SeaweedFS 4.24 release.
Rotate any filer JWT signing keys and reissue tenant tokens after upgrading to invalidate potentially abused tokens.
Audit filer access logs for cross-tenant activity that predates the upgrade, focusing on tenants whose names share leading substrings.

Patch Information

The fix is delivered in SeaweedFS 4.24 via pull request #9439 and commit 05ed5c9. Details are documented in the GHSA-gv5w-hfx8-8cwq security advisory. The change scopes allowed_prefixes checks to path components using Go's path package.

Workarounds

Rename tenant directories so no tenant path is a lexical prefix of another (for example, use /tenant1/ and /tenant0002/ rather than /tenant1 and /tenant1234).
Restrict filer network exposure to trusted service meshes and require mutual TLS until the upgrade is deployed.
Terminate filer traffic behind a reverse proxy that enforces per-tenant path allowlists using component-aware matching.

bash

# Verify running SeaweedFS filer version
weed version

# Upgrade the SeaweedFS binary to 4.24
curl -L -o /usr/local/bin/weed \
  https://github.com/seaweedfs/seaweedfs/releases/download/4.24/weed
chmod +x /usr/local/bin/weed
systemctl restart seaweedfs-filer

# Confirm the upgrade
weed version | grep 4.24