CVE-2026-73080: CVE-2026-73080: Unauthenticated Server-Side Request Forgery (SSRF) in SeaweedFS Volume Server

#security #cve #cybersecurity

CVE-2026-73080: Unauthenticated Server-Side Request Forgery (SSRF) in SeaweedFS Volume Server

Vulnerability ID: CVE-2026-73080
CVSS Score: 9.3
Published: 2026-08-11

A critical-severity Server-Side Request Forgery (SSRF) vulnerability exists in SeaweedFS volume servers prior to version 4.24. Unauthenticated attackers can trigger arbitrary HTTP requests to internal networks and cloud metadata services via the gRPC endpoint and retrieve the response data.

TL;DR

Unauthenticated remote attackers can abuse a gRPC endpoint in SeaweedFS to perform full-read Server-Side Request Forgery (SSRF), exposing internal services and cloud instance metadata.

Technical Details

CWE ID: CWE-918
Attack Vector: Network
CVSS Score: 9.3
Exploit Status: None
CISA KEV Status: Not Listed

Affected Systems

SeaweedFS Volume Server
SeaweedFS: < 4.24 (Fixed in: 4.24)

Code Analysis

Commit: 69da20b

implement guarded dialer to prevent SSRF and DNS rebinding in FetchAndWriteNeedle

Mitigation Strategies

Upgrade SeaweedFS to version 4.24 or higher
Restrict gRPC ports (e.g., 18080) to trusted cluster members
Ensure -volume.allowUntrustedRemoteEndpoints is not enabled
Enforce IMDSv2 with a hop limit of 1 on cloud instances

Remediation Steps:

Identify all running instances of SeaweedFS Volume Servers.
Update the SeaweedFS binaries or container images to version 4.24 or higher.
Verify that the startup flags do not contain -volume.allowUntrustedRemoteEndpoints.
Apply firewall rules or security group policies to block public gRPC access.
Monitor gRPC traffic for unauthorized FetchAndWriteNeedle calls.

References

Read the full report for CVE-2026-73080 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community