CVE-2026-77298

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.40

Description The S3 API accepts an external OIDC JWT (OpenID Connect JSON Web Token) sent directly in the Authorization header and maps it to an IAM role without enforcing the trust policy of that role. While the standard STS AssumeRoleWithWebIdentity() path correctly rejects tokens when the trust policy does not trust the federated provider, the direct S3 bearer path only validates the token itself. This allows a valid OIDC user to bypass trust policy restrictions and obtain S3 access, including the ability to read, write, and delete objects, by presenting the raw OIDC JWT directly to the S3 API.

Recommendations Update to version 4.40.