GHSA-hgpf-8634-g44c: Medium severity go/github.com/seaweedfs/seaweedfs vulnerability
Summary SeaweedFS routes requests signed with SigV4 service s3tables to the S3Tables management API. Authorization on that path collapsed account-less S3 identities into the shared admin account and failed open, so a user holding only ordinary S3 Read credentials — and no S3Tables-specific permission — could invoke S3Tables management operations such as GET /buckets and enumerate administrator-owned table bucket inventory (names and ARNs). The same handler backs the Iceberg REST catalog, which was affected by the same flaw.
Impact An authenticated low-privileged S3 user can cross the boundary between ordinary S3 object access and S3Tables management. Confirmed impact is disclosure of administrator-owned table bucket inventory (bucket names and ARNs); in shared or multi-tenant deployments this can reveal tenant naming and operational structure.
Affected versions SeaweedFS >= 4.08, < 4.34 (the S3Tables management API was introduced in 4.08).
Patched versions Fixed in 4.34 (#9961). Administrator status is now decided by the ACTIONADMIN capability rather than by a collapsed admin account id, S3Tables authorization no longer defaults to allow, and the tautological ListTableBuckets gate was removed. Related hardening of the same root cause landed in #9962, #9963, and #9971.
Workaround No configuration workaround — upgrade to 4.34 or later.
Credit Reported by TA-MU-TA.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/seaweedfs/seaweedfsto a version that resolves this vulnerability.Fixed in 0.0.0-20260614205536-b13463880c1f - Upgrade
Upgrade
SeaweedFSto a version that resolves this vulnerability.Fixed in 4.34Patch #9961
Event History
Frequently Asked Questions
Which deployments are affected?
SeaweedFS versions 4.08 through 4.33 are affected. The vulnerable S3Tables management API was introduced in 4.08, and version 4.34 contains the fix.
What access does an attacker need?
An attacker needs authenticated ordinary S3 credentials with Read access. They do not need S3Tables-specific permission or administrator privileges, and no user interaction is required.
What information could be exposed?
The confirmed impact is enumeration of administrator-owned table bucket inventory, including bucket names and ARNs. In shared or multi-tenant environments, this can disclose tenant naming and operational structure.
Are Iceberg REST catalog requests also affected?
Yes. The same vulnerable handler backs the Iceberg REST catalog, so it was affected by the same authorization flaw.
How can this be remediated?
Upgrade SeaweedFS to version 4.34. The fix bases administrator status on the ACTION_ADMIN capability and removes the default-allow behavior from S3Tables authorization.