seaweedfs has 7 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 1 in the 90 before. The busiest recent month was August 2026 with 5. The median CVSS is 8.1 (high), with 2 rated critical. None have a confirmed exploitation report. Most affected products: github.com/seaweedfs/seaweedfs (5), seaweedfs (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 6 prev 1
Products
- github.com/seaweedfs/seaweedfs 5
- seaweedfs 2
Worst active — by depth score
CVE-2026-58372High· 8.1SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' bucke…57CVE-2026-54917HighSeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access54CVE-2026-72920Critical· 9.8SeaweedFS is a distributed storage system54CVE-2026-73080Critical· 9.3SeaweedFS is a distributed storage system51CVE-2026-72921High· 8.1SeaweedFS is a distributed storage system45
seaweedfs vulnerabilities
CVEs affecting seaweedfs, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-100413High· 7.0SeaweedFS is a distributed storage system for files and blobs
SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfs…
CVE-2026-55873Medium· 4.3SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
CVE-2026-54917HighPoCSeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
CVE-2026-72921High· 8.1SeaweedFS is a distributed storage system
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling…
CVE-2026-72920Critical· 9.8SeaweedFS is a distributed storage system
SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, allowing any client that can reach the f…
CVE-2026-73080Critical· 9.3SeaweedFS is a distributed storage system
SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the …
CVE-2026-58372High· 8.1PoCSeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' bucke…
SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' bucke…