SeaweedFS SSRF Vulnerability: Critical Update for Versions Before 4.24
- Severity
- HIGH
- Affected component
- seaweedfs (go)
- Affected versions
- < 0.0.0-20260512171120-69da20bdaec9
- Patched version
- 4.24
SeaweedFS versions before 4.24 are reportedly vulnerable to an unauthenticated SSRF attack that can expose instance metadata and IAM credentials on cloud deployments.
What happened
An unauthenticated SSRF vulnerability has been identified in SeaweedFS versions prior to 4.24. This vulnerability, tracked as GHSA-87FV-VQQR-M4JR and CVE-2026-73080, allows an attacker to perform Server-Side Request Forgery (SSRF) with response read-back via the VolumeServer.FetchAndWriteNeedle method. This can result in the disclosure of sensitive instance metadata and IAM credentials in cloud environments. The vulnerability was first flagged on August 11, 2026, and is currently under investigation.
The affected component is the seaweedfs (go) package, with versions less than 0.0.0-20260512171120-69da20bdaec9 identified as vulnerable. Users of these versions should assess their exposure and take immediate action to mitigate the risk.
What to do about it
- Upgrade SeaweedFS to version 4.24 or later to mitigate the SSRF vulnerability.
- Review your cloud deployment configurations to ensure that sensitive metadata and IAM credentials are adequately protected.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation recommendations.
How 0Day would have caught this
seaweedfs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using SeaweedFS versions before 4.24, you are potentially affected by this vulnerability.
What should I do right now?
Upgrade to SeaweedFS version 4.24 or later as soon as possible to mitigate the risk.
Is this vulnerability being exploited in the wild?
There is no confirmed evidence that this vulnerability is being exploited in the wild at this time.