CVE-2026-77368: SeaweedFS Authenticated Cross-Prefix IDOR Vulnerability
Summary
CVE-2026-77368: SeaweedFS is a distributed storage system for files and blobs. Affects seaweedfs versions >= 4.39.0, < 4.40.0. Fixed in 4.40.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SeaweedFS is a distributed storage system designed for managing files and blobs efficiently. It allows users to store and retrieve data in a scalable manner, making it suitable for various applications. The system supports features like JWT authentication for securing access to resources. However, a vulnerability was discovered in version 4.39 that affects the TUS resumable-upload handler, which could lead to unauthorized access and data manipulation.
Vulnerability Detail
The vulnerability arises from the TUS resumable-upload handler in SeaweedFS, which improperly checks JWT allowed_prefixes. When a session is created, it only verifies the allowed prefixes, but subsequent operations like HEAD, PATCH, and DELETE do not validate whether the session's target path is within the caller's allowed prefixes. This flaw allows a low-privilege tenant to hijack another tenant's upload session, enabling them to write data to paths that should be forbidden. The attacker can also delete other tenants' sessions and read upload progress, undermining the intended isolation provided by JWT prefix restrictions.
How To Fix
Minimum fixed version
4.40.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling TUS uploads if they are not essential for your application. This can be done by modifying the configuration settings in your SeaweedFS deployment to prevent the use of the TUS handler until the patch is applied.
Conclusion
The CVE-2026-77368 vulnerability in SeaweedFS poses significant risks to tenant data integrity and security. It is crucial for users to update to version 4.40 or later to protect against unauthorized access and manipulation of upload sessions. Implementing the recommended fixes and workarounds will help secure your deployment.
See every vulnerability recorded for seaweedfs →
FAQ
CVE-2026-77368 is a vulnerability in SeaweedFS that allows low-privilege tenants to hijack upload sessions and write to unauthorized paths.
The vulnerability affects SeaweedFS version 4.39.0 and earlier. It is fixed in version 4.40.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The risks include unauthorized data manipulation, session hijacking, and the ability to delete or read other tenants' upload sessions, which can lead to data breaches.
If an immediate update is not possible, consider disabling TUS uploads as a temporary workaround to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for seaweedfs.
