{"cve":"CVE-2026-73080","nvd":{"published":"2026-08-11T16:17:39.857","modified":"2026-09-09T20:46:02.457","status":"Deferred","description":"SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the response into a needle. The RPC performs no authentication and no target validation, allowing anyone who can reach a volume server's gRPC port to cause requests to arbitrary hosts, including loopback, link-local, RFC 1918, and cloud metadata endpoints such as 169.254.169.254, and read the response. On cloud deployments, this can disclose instance metadata and IAM credentials and reach otherwise unexposed internal services. The volume server gRPC plane is unauthenticated by default, and configuring documented JWT signing keys does not protect this RPC. This issue is fixed in version 4.24.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","score":9.3},"cwes":["CWE-918"],"references":["https://github.com/seaweedfs/seaweedfs/commit/69da20bdaec923e5a43d8aa71bf3c0a2051fc019","https://github.com/seaweedfs/seaweedfs/pull/9441","https://github.com/seaweedfs/seaweedfs/releases/tag/4.24","https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-87fv-vqqr-m4jr"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:47:54.990491175+00:00"},"epss":{"cve":"CVE-2026-73080","score":0.00527,"percentile":0.4466,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-87fv-vqqr-m4jr","url":"https://osv.dev/vulnerability/GHSA-87fv-vqqr-m4jr","summary":"SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle","modified":"2026-08-18T15:11:03.487858095Z","packages":[{"ecosystem":"Go","name":"github.com/seaweedfs/seaweedfs","purl":"pkg:golang/github.com/seaweedfs/seaweedfs","ranges":["<0.0.0-20260512171120-69da20bdaec9"],"fixed":["0.0.0-20260512171120-69da20bdaec9"]}]},{"id":"GO-2026-6219","url":"https://osv.dev/vulnerability/GO-2026-6219","summary":"SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle in github.com/seaweedfs/seaweedfs","modified":"2026-08-18T15:11:03.487858095Z","packages":[{"ecosystem":"Go","name":"github.com/seaweedfs/seaweedfs","purl":"pkg:golang/github.com/seaweedfs/seaweedfs","ranges":["<0.0.0-20260512171120-69da20bdaec9"],"fixed":["0.0.0-20260512171120-69da20bdaec9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}