SeaweedFS IAM gRPC Service Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- seaweedfs (go)
- Affected versions
- < 0.0.0-20260512171108-5e8f99f40a8a
- Patched version
- 4.24
An early warning has been issued regarding a high-severity vulnerability in the SeaweedFS IAM gRPC service. This vulnerability, tracked as GHSA-2V6V-25FM-P4FG, allows unauthenticated access to administrative RPCs.
What happened
The SeaweedFS IAM gRPC service was reportedly unauthenticated, which allowed any client to invoke administrative RPCs. This vulnerability is under investigation and has been fixed in version 4.24 by requiring a Bearer token signed with the admin key. The vulnerability was first flagged on September 2, 2026. The affected versions are those prior to 0.0.0-20260512171108-5e8f99f40a8a.
To assess your exposure, check if you are using SeaweedFS versions prior to 0.0.0-20260512171108-5e8f99f40a8a. If so, it is recommended to upgrade to version 4.24 and configure JWT signing keys in `security.toml`. Ensure that IAM RPCs use an admin-signed Bearer token.
What to do about it
- Upgrade to SeaweedFS version 4.24.
- Configure JWT signing keys in `security.toml`.
- Ensure that IAM RPCs use an admin-signed Bearer token.
- Monitor the primary sources for updates on this vulnerability.
How 0Day would have caught this
seaweedfs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using SeaweedFS versions prior to 0.0.0-20260512171108-5e8f99f40a8a.
What should I do right now?
Upgrade to SeaweedFS version 4.24, configure JWT signing keys in `security.toml`, and ensure that IAM RPCs use an admin-signed Bearer token.
Where can I find more information about this vulnerability?
Consult the primary sources: [GHSA-2v6v-25fm-p4fg](https://github.com/advisories/GHSA-2v6v-25fm-p4fg) and [GHSA-2v6v-25fm-p4fg](https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-2v6v-25fm-p4fg).