CVE-2026-55873: Improper Authorization in SeaweedFS S3Tables and Iceberg REST Management APIs
Vulnerability ID: CVE-2026-55873
CVSS Score: 4.3
Published: 2026-08-28
An improper authorization vulnerability in SeaweedFS versions 4.08 through 4.33 allows authenticated, low-privileged users to bypass directory isolation and perform unauthorized metadata operations within S3Tables and Iceberg REST interfaces. The vulnerability arises from an automatic collapse of account-less static identities to the default administrative principal, combined with a fail-open default policy configuration and self-referential authorization parameters in the table bucket listing routines. Together, these logical flaws expose administrative configurations and namespace architectures to unprivileged actors. The issue is resolved in version 4.34 by enforcing capability-based access checks, isolating fallback modes, and performing granular access verification on target buckets.
TL;DR
SeaweedFS S3Tables and Iceberg REST APIs incorrectly map account-less static S3 identities to the administrative role. Under default configurations, this behavior lets standard authenticated users bypass namespace isolation boundaries and access all table buckets. Upgrading to SeaweedFS version 4.34 fixes this issue.
Technical Details
- CWE ID: CWE-863 (Incorrect Authorization)
- Attack Vector: Network (Remote)
- CVSS Score: 4.3 (Medium)
- EPSS Score: 0.00342 (26.83% percentile)
- Exploit Status: None (Analytical only)
- KEV Status: Not listed in CISA KEV
Affected Systems
- SeaweedFS S3Tables
- SeaweedFS Iceberg REST Catalog
-
SeaweedFS: >= 4.08, < 4.34 (Fixed in:
4.34)
Code Analysis
Commit: b134638
Enforce strict identity checks for S3Tables API and prevent automatic escalation of account-less static users to admin.
Mitigation Strategies
- Upgrade SeaweedFS to version 4.34 or higher to enforce proper permission validation.
- Implement network firewalls or security groups to restrict access to S3Tables and Iceberg REST endpoints.
- Define explicit 'Deny' policies for low-privileged users to override the default-allow fallback logic.
Remediation Steps:
- Audit existing SeaweedFS deployments to identify versions between 4.08 and 4.33.
- Download and deploy the SeaweedFS v4.34 package or container image.
- Restart the services and verify that S3Tables configuration settings are properly restricted.
- Test with a low-privileged test account to ensure table bucket listings are filtered based on actual ownership.
References
Read the full report for CVE-2026-55873 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)