CVE-2026-72921: CVE-2026-72921: Incorrect Authorization in SeaweedFS Filer JWT Prefix Match

#security #cve #cybersecurity

CVE-2026-72921: Incorrect Authorization in SeaweedFS Filer JWT Prefix Match

Vulnerability ID: CVE-2026-72921
CVSS Score: 8.1
Published: 2026-09-02

SeaweedFS is a distributed storage system. Prior to version 4.24, the Filer JWT validation mechanism used a raw prefix match, allowing scoped tokens to access sibling directories sharing similar name prefixes.

TL;DR

SeaweedFS Filer prior to 4.24 uses raw prefix matching on raw path strings during JWT validation, allowing scoped tokens to authorize unauthorized access to sibling directories (e.g., /tenant1 matching /tenant1234).

Technical Details

CWE ID: CWE-863
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 8.1 (High)
EPSS Score: 0.00238 (0.24%)
Exploit Status: none
KEV Status: Not Listed

Affected Systems

SeaweedFS Filer
Wolfi
Chainguard
SeaweedFS: < 4.24 (Fixed in: 4.24)

Code Analysis

Commit: 05ed5c9

Fix pathHasComponentPrefix implementation in Filer JWT authorization

Mitigation Strategies

Upgrade SeaweedFS to version 4.24 or later to enforce component-aware path authorization.
Refactor tenant namespace directories to prevent overlapping suffix names.
Enforce trailing slashes on all scoped JWT AllowedPrefixes claims.

Remediation Steps:

Identify current SeaweedFS Filer version.
Download SeaweedFS 4.24 or a later stable release.
Apply the update across all active Filer instances in the cluster.
Verify JWT configuration and trailing slashes for existing clients.

References

Read the full report for CVE-2026-72921 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community