CVE-2026-77368: SeaweedFS Authentication Bypass Vulnerability

CVE-2026-77368 Overview

CVE-2026-77368 is a broken access control vulnerability in SeaweedFS, a distributed storage system for files and blobs. The filer's TUS (Tus Resumable Upload) handler enforces JWT allowed_prefixes scoping only during session creation. Once a session exists, the HEAD, PATCH, and DELETE verbs operating on a session identifier never re-validate that the session's stored target path falls within the caller's allowed prefixes. A low-privilege tenant who obtains another tenant's upload session ID can write attacker-controlled bytes to out-of-scope filer paths, delete other tenants' sessions, or read upload progress metadata. The flaw affects version 4.39 and is fixed in version 4.40.

Critical Impact
A tenant with a prefix-scoped filer JWT can hijack another tenant's in-progress TUS upload, causing attacker-controlled content to land at a filer path outside its authorized prefix.

Affected Products

SeaweedFS version 4.39 with filer JWT signing enabled
SeaweedFS deployments with TUS resumable uploads enabled
Multi-tenant SeaweedFS filer installations using allowed_prefixes scoping

Discovery Timeline

2026-08-26 - CVE-2026-77368 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77368

Vulnerability Analysis

The vulnerability is an insecure direct object reference [CWE-639] in the SeaweedFS filer's TUS handler. TUS is a resumable upload protocol where clients create an upload session and then interact with it by session ID across multiple HTTP verbs. In SeaweedFS 4.39, the filer validates JWT allowed_prefixes scoping when the session is created through a POST but not when subsequent HEAD, PATCH, or DELETE requests reference the session by ID.

Because the session ID is the sole authorization anchor after creation, any tenant that learns another tenant's upload ID can operate on it. A PATCH request writes bytes into the victim's session. When the upload finalizes, the filer stores the assembled object at the session's original TargetPath, which may reside under a prefix the attacker's JWT never authorized. DELETE removes cross-tenant sessions, and HEAD leaks the upload's stored size and offset.

Root Cause

The TUS handler resolves session-scoped requests against r.URL.Path (pointing at the /.tus route) rather than resolving against the session's persisted TargetPath. The pre-patch checkJwtAuthorization accepted a static scopedPaths slice built from the request URL, so the JWT authorizer never saw the actual filesystem path the operation would affect.

Attack Vector

An authenticated tenant with a prefix-restricted filer JWT enumerates or otherwise obtains another tenant's TUS upload ID from the /.tus/.uploads/ namespace. The attacker then issues PATCH, DELETE, or HEAD requests against that ID using their own valid but out-of-scope JWT.

// Pre-patch: authorization uses only the request URL path,
// not the session's stored TargetPath.
return fs.checkJwtAuthorization(r, isWrite, jwtScopedRequestPaths(r))

// Post-patch (commit ce82e3a): authorization takes a resolver
// so the TUS handler can supply the session's stored path.
return fs.checkJwtAuthorization(r, isWrite, func() ([]string, error) {
    return jwtScopedRequestPaths(r), nil
})

// Follow-up hardening (commit fa549e9): authentication is split
// from path authorization so the indirect session target is only
// loaded after JWT signature validation succeeds.
func (fs *FilerServer) authenticateFilerJwt(
    r *http.Request, isWrite bool,
) (*security.SeaweedFilerClaims, bool)

Source: GitHub Commit ce82e3a and GitHub Commit fa549e9

Detection Methods for CVE-2026-77368

Indicators of Compromise

HEAD, PATCH, or DELETE requests to /.tus/.uploads/{id} where the requesting JWT's allowed_prefixes do not cover the session's stored TargetPath.
Multiple distinct JWT subjects issuing requests against the same TUS upload ID within a single session lifetime.
Files appearing at filer paths that were not created by any authorized POST from a JWT scoped to that prefix.

Detection Strategies

Correlate filer access logs by TUS upload ID and compare the JWT subject or allowed_prefixes on the creating POST against the subject on subsequent PATCH, HEAD, and DELETE requests.
Alert on TUS session DELETE operations issued by a JWT subject different from the session's creator.
Baseline per-tenant TUS upload volume and flag anomalous cross-prefix write activity terminating at foreign paths.

Monitoring Recommendations

Enable verbose filer request logging that includes JWT subject, allowed_prefixes, HTTP method, and resolved TargetPath.
Ship filer logs to a centralized analytics platform and build detections that join upload session creation events with subsequent verbs on the same session ID.
Monitor for unexpected object writes under sensitive prefixes and reconcile them against authorized session creators.

How to Mitigate CVE-2026-77368

Immediate Actions Required

Upgrade SeaweedFS to version 4.40, which contains the fixes from commits ce82e3a and fa549e9.
If upgrade is not immediately possible, disable TUS uploads on the filer until the patch can be applied.
Rotate filer JWT signing keys and invalidate outstanding TUS session IDs after upgrading.

Patch Information

The primary fix is delivered in GitHub Commit ce82e3a, which changes checkJwtAuthorization to accept a resolveScopedPaths callback so the TUS handler resolves the session's stored TargetPath before authorization. A follow-up hardening commit, GitHub Commit fa549e9, splits JWT authentication from path authorization and adds isCanonicalTusUploadID validation in readTusSessionInfo to reject corrupt or replaced session metadata. Full details are documented in the GitHub Security Advisory GHSA-99q7-x53r-6j4g.

Workarounds

Disable TUS uploads on filers that require JWT prefix isolation until the 4.40 upgrade is deployed.
Restrict filer network exposure to trusted callers and terminate TUS traffic at an authenticating reverse proxy that enforces per-tenant path scoping.
Issue short-lived JWTs and reduce the practical window in which stolen or guessed session IDs remain useful.

bash

# Verify running version and upgrade path
weed version

# Upgrade to patched release
wget https://github.com/seaweedfs/seaweedfs/releases/download/4.40/linux_amd64.tar.gz
tar -xzf linux_amd64.tar.gz
sudo mv weed /usr/local/bin/weed

# Confirm the fix is present
weed version | grep -E "4\.(4[0-9]|[5-9][0-9])"