SeaweedFS IAM gRPC Service Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- seaweedfs (github-actions)
- Patched version
- 4.24
An early warning has been issued for a critical vulnerability in the SeaweedFS IAM gRPC service. This vulnerability, tracked as GHSA-2V6V-25FM-P4FG, could allow unauthenticated clients to invoke administrative RPCs.
What happened
An early warning has been issued for a critical vulnerability in the SeaweedFS IAM gRPC service. This vulnerability, tracked as GHSA-2V6V-25FM-P4FG, reportedly allows unauthenticated clients to invoke administrative RPCs. The issue has been addressed in SeaweedFS version 4.24, which now requires a Bearer token signed with the filer admin signing key for IAM RPCs.
The vulnerability was first flagged on September 2, 2026. It is classified as a critical CVE and has not yet been exploited in the wild. The affected component is the seaweedfs package, specifically versions prior to 4.24.
What to do about it
- Upgrade to SeaweedFS version 4.24.
- Configure `jwt.filer_signing.key` in `security.toml`.
- Ensure all IAM RPCs use an admin-signed Bearer token.
- Monitor the primary sources for updates on this vulnerability.
How 0Day would have caught this
seaweedfs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using SeaweedFS versions prior to 4.24.
What should I do right now?
Upgrade to SeaweedFS version 4.24 and configure `jwt.filer_signing.key` in `security.toml`. Ensure all IAM RPCs use an admin-signed Bearer token.
Has this been exploited in the wild?
No, this vulnerability has not been exploited in the wild.