CVE-2026-72920

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.24

Description The filer registers the SeaweedIdentityAccessManagement gRPC service without requiring authentication when the jwt.filer signing.key is unset. This allows any client with access to the filer gRPC port to invoke IAM RPCs, including CreateUser(), CreateAccessKey(), and PutPolicy(), to generate credentials and obtain S3 administrative control.

Recommendations Update to version 4.24. Set the jwt.filer signing.key to ensure mandatory authentication for the gRPC service.