CVE-2026-73080: SeaweedFS Information Disclosure Flaw

CVE-2026-73080 Overview

CVE-2026-73080 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in SeaweedFS, a distributed storage system. The flaw resides in the VolumeServer.FetchAndWriteNeedle RPC implemented in weed/server/volume_grpc_remote.go. The RPC accepts a caller-supplied remote endpoint and fetches its contents through the S3 storage client at weed/remote_storage/s3/s3_storage_client.go, writing the response into a needle. The volume server gRPC plane is unauthenticated by default, and configuring documented JWT signing keys does not protect this RPC. Any attacker with network reach to the volume server gRPC port can trigger requests to arbitrary hosts and read the responses. The issue affects all versions prior to 4.24 and is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
On cloud deployments, attackers can exfiltrate instance metadata and IAM credentials from endpoints such as 169.254.169.254, and reach internal services on loopback, link-local, and RFC 1918 networks.

Affected Products

SeaweedFS versions prior to 4.24
SeaweedFS volume server (gRPC plane)
Cloud deployments of SeaweedFS on AWS, GCP, Azure, and other providers exposing metadata endpoints

Discovery Timeline

2026-08-11 - CVE-2026-73080 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-73080

Vulnerability Analysis

The SeaweedFS volume server exposes a gRPC endpoint FetchAndWriteNeedle intended to pull remote S3 objects and persist them into local needle storage. The handler in weed/server/volume_grpc_remote.go accepts an S3-compatible endpoint URL directly from the RPC caller and passes it to the S3 client without validating the target host. There is no authentication requirement on the gRPC plane by default, and JWT signing keys do not protect this specific RPC. An attacker who can reach the gRPC port can supply a URL pointing at loopback, link-local, RFC 1918, or cloud metadata addresses. The server performs the outbound HTTP request from its own network position and returns the response body, effectively turning the volume server into an authenticated proxy into the internal network.

Root Cause

The root cause is missing authentication and missing target validation on a network-facing RPC. The FetchAndWriteNeedle handler trusts caller-supplied endpoint parameters and does not enforce an allowlist, deny loopback/link-local addresses, or verify caller identity before initiating outbound HTTP traffic.

Attack Vector

Attack traffic is delivered over the network to the volume server gRPC port. The attacker invokes FetchAndWriteNeedle with a crafted remote endpoint such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ on AWS. The volume server fetches the URL, writes the response into a needle, and the attacker retrieves the stored data through normal SeaweedFS read paths.

The upstream fix introduces a boolean flag that rejects internal endpoints by default:

miniOptions.v.allowUntrustedRemoteEndpoints = cmdMini.Flag.Bool(
    "volume.allowUntrustedRemoteEndpoints",
    false,
    "if true, FetchAndWriteNeedle accepts arbitrary remote S3 endpoints "+
    "including loopback / link-local hosts. Default rejects internal / "+
    "metadata endpoints.",
)

Source: GitHub commit 69da20bd in weed/command/mini.go. The identical flag is added to weed/command/server.go to gate the RPC across both deployment modes.

Detection Methods for CVE-2026-73080

Indicators of Compromise

Outbound HTTP requests from SeaweedFS volume server hosts to 169.254.169.254, fd00:ec2::254, or metadata.google.internal
Volume server connections to loopback (127.0.0.0/8), link-local (169.254.0.0/16), or unexpected RFC 1918 destinations
Unusual gRPC calls to FetchAndWriteNeedle from non-cluster source addresses
Newly created needles whose stored content resembles JSON IAM credential payloads or cloud metadata documents

Detection Strategies

Inspect volume server access logs for FetchAndWriteNeedle RPC calls originating outside the trusted cluster subnet
Correlate SeaweedFS process network telemetry with cloud metadata service endpoints using host-based monitoring
Deploy egress network policies at the workload level and alert on any blocked attempts from volume server pods or hosts

Monitoring Recommendations

Enable and centralize volume server gRPC audit logging, then baseline expected caller identities and endpoints
Monitor cloud provider audit trails (AWS CloudTrail, GCP Cloud Audit Logs) for unexpected use of instance-role credentials assigned to SeaweedFS hosts
Alert on new IAM credential usage from IP addresses outside the SeaweedFS deployment

How to Mitigate CVE-2026-73080

Immediate Actions Required

Upgrade all SeaweedFS volume servers to version 4.24 or later, which gates FetchAndWriteNeedle behind admin authentication and rejects internal endpoints by default
Restrict network access to the volume server gRPC port using firewall or Kubernetes NetworkPolicy so only trusted cluster components can reach it
Rotate any IAM credentials, tokens, or secrets accessible from the metadata service on SeaweedFS hosts if exposure is suspected
On AWS, enforce IMDSv2 with hop limit set to 1 to prevent SSRF-based metadata theft

Patch Information

The fix is available in SeaweedFS release 4.24. See Pull Request #9441 and commit 69da20bd for implementation details. Full context is documented in GitHub Security Advisory GHSA-87fv-vqqr-m4jr.

Workarounds

Block network access to the volume server gRPC port from any host outside the SeaweedFS cluster
Enforce cloud provider metadata protections such as IMDSv2 with restricted hop counts before upgrading
Do not enable the volume.allowUntrustedRemoteEndpoints flag unless the volume server is fully isolated from internal and metadata networks

bash

# After upgrading to 4.24+, run the volume server with defaults
# (allowUntrustedRemoteEndpoints=false) to reject internal/metadata endpoints
weed volume \
    -dir=/data \
    -mserver=master:9333 \
    -port=8080 \
    -volume.allowUntrustedRemoteEndpoints=false