CVE-2026-72921: SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
weed/server/filer_server_handlers.go (SeaweedFS Filer JWT allowed_prefixes)to a version that resolves this vulnerability.Fixed in 4.24
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72921?
The severity of CVE-2026-72921 is rated high with a score of 8.1.
What are the potential risks associated with CVE-2026-72921?
CVE-2026-72921 allows cross-tenant access to sibling paths, leading to unauthorized access to sensitive data.
How do I fix CVE-2026-72921?
To fix CVE-2026-72921, upgrade to SeaweedFS version 4.24 or later where the authorization check has been corrected.
Who is affected by CVE-2026-72921?
Users of SeaweedFS versions prior to 4.24 are affected by CVE-2026-72921.
What is the primary issue described in CVE-2026-72921?
The primary issue in CVE-2026-72921 is that the allowed_prefixes authorization check incorrectly allows access to sibling paths.