SeaweedFS Filer IAM gRPC Service Allows Unauthenticated S3 Admin Takeover (GHSA-2v6v-25fm-p4fg)

What happened

A critical advisory (GHSA-2v6v-25fm-p4fg, CVE-2026-72920, CVSS 9.8) reports that SeaweedFS's filer component registered its IAM gRPC service (SeaweedIdentityAccessManagement) without any authentication. Any client able to reach the filer gRPC port could invoke IAM RPCs such as CreateUser, CreateAccessKey, and PutUserPolicy to mint new credentials and grant itself S3 administrative privileges. Notably, the documented JWT signing-key mechanism did not gate this service, and even mTLS deployments were exposed because the allowed_commonNames ACL applies at the listener level rather than per-RPC — so any certificate valid for the cluster mesh could still reach the administrative calls. The affected code lives in weed/server/filer_server_handlers_iam_grpc.go and weed/command/filer.go. The issue is fixed in version 4.24, which now requires a Bearer token signed with the filer admin key on every IAM RPC and refuses to start the service without a configured signing key. A public PoC reportedly exists.

Why it matters

SeaweedFS is used as a distributed object storage and filesystem backend, often underpinning S3-compatible services. An attacker with network access to the filer gRPC port — no credentials required — can fully compromise the confidentiality, integrity, and availability of all stored objects by self-issuing admin S3 credentials. Organizations running multi-tenant or exposed SeaweedFS clusters, including those relying on mTLS for isolation, should treat this as a critical, unauthenticated remote compromise path rather than a defense-in-depth gap.

What defenders should do now

• Upgrade affected SeaweedFS deployments to 4.24 as soon as possible.
• Until patched, restrict network access to the filer gRPC port to trusted hosts only — do not rely on JWT signing keys or mTLS common-name ACLs alone, as neither closes this gap on prior versions.
• Configure jwt.filer_signing.key in security.toml and ensure any legitimate IAM RPC callers are updated to attach an admin-signed Bearer token, since 4.24 enforces this on every call.
• Hunt for unexpected IAM activity: unfamiliar CreateUser, CreateAccessKey, or PutUserPolicy calls in filer logs, newly created S3 access keys with administrative policies, or gRPC connections to the filer port from unexpected source hosts.
• Audit existing S3 credentials and IAM policies on any SeaweedFS cluster that was reachable from untrusted networks prior to patching, since credentials could already have been minted.

Developing intel

This is a same-day advisory and details may evolve as the community and vendor publish follow-up fixes (tracked upstream as PR #9442 with follow-ups #9498, #9508, #9514, #9536). We will continue to monitor for updates. Read the original GitHub Security Advisory for full technical details: GHSA-2v6v-25fm-p4fg.