CVE-2026-72921: SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
Impact When a filer JWT restricts a token to a set of path prefixes via allowedprefixes, the authorization check used a literal byte-prefix match (strings.HasPrefix). A token scoped to /tenant1 therefore also authorized requests to sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup.
In a multi-tenant deployment this lets the holder of one tenant's token access another tenant's data. Because allowedprefixes gates both read and write tokens, the impact covers cross-tenant reads and writes. A valid scoped token is required, so this is an authorization bypass rather than a fully unauthenticated flaw.
Affected component - weed/server/filerserverhandlers.go (JWT allowedprefixes authorization check)
Patches Fixed in 4.24. The check now matches on /-separated path components after path.Clean normalisation, so /tenant1 authorizes only /tenant1 and its descendants — not /tenant1234 or other sibling paths.
Workarounds Where feasible, choose prefix names that are not string-prefixes of one another (e.g. keep a trailing separator convention). Upgrade to 4.24.
References - Reported by Kadir Arslan (https://github.com/KadirArslan)
Other sources
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/seaweedfs/seaweedfsto a version that resolves this vulnerability.Fixed in 0.0.0-20260512171048-05ed5c9ae8a2 - Upgrade
Upgrade
SeaweedFSto a version that resolves this vulnerability.Fixed in 4.24 - Configuration
Modify the filer JWT `allowed_prefixes` authorization check in `weed/server/filer_server_handlers.go` to match on `/`-separated path components after `path.Clean` normalization (instead of a raw literal byte-prefix match).
weed/server/filer_server_handlers.go (JWT allowed_prefixes authorization check) allowed_prefixes prefix matching logic = path.Clean + /-separated path components (token scoped to /tenant1 authorizes only /tenant1 and descendants) - Compensating control
When configuring filer JWT `allowed_prefixes` (where feasible), choose prefix names that are not string-prefixes of each other (e.g., keep a trailing separator convention) to avoid `/tenant1` matching sibling paths like `/tenant1234`.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72921?
The severity of CVE-2026-72921 is rated high with a score of 8.1.
What are the potential risks associated with CVE-2026-72921?
CVE-2026-72921 allows cross-tenant access to sibling paths, leading to unauthorized access to sensitive data.
How do I fix CVE-2026-72921?
To fix CVE-2026-72921, upgrade to SeaweedFS version 4.24 or later where the authorization check has been corrected.
Who is affected by CVE-2026-72921?
Users of SeaweedFS versions prior to 4.24 are affected by CVE-2026-72921.
What is the primary issue described in CVE-2026-72921?
The primary issue in CVE-2026-72921 is that the allowed_prefixes authorization check incorrectly allows access to sibling paths.