CVE-2026-77611: SeaweedFS S3 Authentication Bypass Vulnerability

CVE-2026-77611 Overview

SeaweedFS is a distributed storage system for files and blobs. CVE-2026-77611 is a broken access control flaw [CWE-863] in the S3 API layer of SeaweedFS versions prior to 4.40. An authenticated S3 principal scoped to a nested object key can overwrite an unrelated object outside that scope by calling PutObjectAcl on the key it is authorized to access. The handler authorizes against the requested nested key but writes the updated entry back to the bucket root, replacing content, metadata, owner information, and ACL of the target object. The issue is fixed in SeaweedFS 4.40.

Critical Impact
Authenticated S3 users can overwrite arbitrary bucket-root objects, bypassing per-key IAM scoping and corrupting data integrity across the bucket.

Affected Products

SeaweedFS versions prior to 4.40
Deployments using the static S3 identity file for object-level action scoping
S3 API gateway component (weed/s3api/s3api_object_handlers_acl.go)

Discovery Timeline

2026-08-26 - CVE-2026-77611 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77611

Vulnerability Analysis

The flaw resides in the PutObjectAcl handler within the SeaweedFS S3 API implementation. When a client submits an ACL change for a nested key such as allowed/protected.txt, the handler correctly evaluates authorization against that full path. After the authorization check succeeds, the handler persists the updated entry using the object's basename rather than the original parent directory. The write therefore lands at the bucket root as protected.txt.

Because the persistence layer stores the full entry rather than only ACL metadata, any existing object at the destination is overwritten. Content bytes, user metadata, owner identity, and ACL grants of the scoped source object all replace those of the unrelated target. An attacker with narrow IAM permissions can escalate to arbitrary object overwrite anywhere in the bucket root.

Root Cause

The root cause is inconsistent path handling between the authorization check and the storage write in the ACL handler. The handler decouples the authorized key from the destination path used for the filer update, violating the assumption that scoped ACL updates remain scoped to the requested object.

Attack Vector

Exploitation requires network access to the SeaweedFS S3 endpoint and valid credentials for an S3 identity that permits PutObjectAcl on at least one nested key. The attacker issues a standard S3 PutObjectAcl request against the permitted nested object. The server authorizes the request, then writes the full entry to the bucket root using only the basename, overwriting any object sharing that name at the root level.

// Patch import addition in weed/s3api/s3api_object_handlers_acl.go
// Fix PutObjectAcl writing back to the wrong object for nested keys (#10333)
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 )

// GetObjectAclHandler Get object ACL

Source: SeaweedFS commit 311bc3a

Detection Methods for CVE-2026-77611

Indicators of Compromise

Unexpected object modifications at the bucket root where objects share a basename with nested keys accessible to lower-privileged principals
PutObjectAcl API calls from principals whose IAM scope should not permit modifications to the targeted root object
Object owner or ACL grant changes on root objects that match the identity of a nested-scope principal

Detection Strategies

Audit SeaweedFS S3 API access logs for PutObjectAcl requests followed by unexpected entry mutations at the bucket root
Compare pre- and post-request object hashes for bucket-root objects to identify silent overwrites
Correlate ACL change events with authenticated principal scope defined in the static S3 identity file

Monitoring Recommendations

Enable verbose S3 API logging on the weed s3 gateway and forward events to a centralized logging platform
Track object version drift and unexpected owner reassignments on high-value bucket-root objects
Alert on any PutObjectAcl request where the request path contains a directory separator and a same-named object exists at the bucket root

How to Mitigate CVE-2026-77611

Immediate Actions Required

Upgrade SeaweedFS to version 4.40 or later, which contains the fix in s3api_object_handlers_acl.go
Inventory all bucket-root objects whose basenames collide with nested keys accessible to non-administrative principals
Rotate credentials for any S3 identities suspected of exercising PutObjectAcl prior to patching

Patch Information

The fix is available in SeaweedFS 4.40. The patch corrects the ACL handler to write updates back to the correct parent directory rather than the bucket root. See the SeaweedFS security advisory GHSA-9x53-cjpr-m682 and the upstream commit for implementation details.

Workarounds

Restrict PutObjectAcl permissions in the static S3 identity file until the upgrade is applied
Avoid naming collisions between nested keys and bucket-root objects, particularly for sensitive files
Place the SeaweedFS S3 gateway behind an authenticating reverse proxy that filters PutObjectAcl requests for untrusted principals

bash

# Verify installed SeaweedFS version and upgrade
weed version
# Upgrade to 4.40 or later, then restart the s3 gateway
weed s3 -config=/etc/seaweedfs/s3.json