{"uuid": "818ea670-a3fb-4fcb-b261-24f798532502", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72921", "type": "seen", "source": "https://gist.github.com/alon710/973db52eb7701f6319f995cd1192baf0", "content": "# CVE-2026-72921: CVE-2026-72921: Incorrect Authorization in SeaweedFS Filer JWT Prefix Match\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72921\n\n## Summary\nSeaweedFS is a distributed storage system. Prior to version 4.24, the Filer JWT validation mechanism used a raw prefix match, allowing scoped tokens to access sibling directories sharing similar name prefixes.\n\n## TL;DR\nSeaweedFS Filer prior to 4.24 uses raw prefix matching on raw path strings during JWT validation, allowing scoped tokens to authorize unauthorized access to sibling directories (e.g., /tenant1 matching /tenant1234).\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.1 (High)\n- **EPSS Score**: 0.00238 (0.24%)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SeaweedFS Filer\n- Wolfi\n- Chainguard\n- **SeaweedFS**: < 4.24 (Fixed in: `4.24`)\n\n## Mitigation\n\n- Upgrade SeaweedFS to version 4.24 or later to enforce component-aware path authorization.\n- Refactor tenant namespace directories to prevent overlapping suffix names.\n- Enforce trailing slashes on all scoped JWT AllowedPrefixes claims.\n\n**Remediation Steps:**\n1. Identify current SeaweedFS Filer version.\n2. Download SeaweedFS 4.24 or a later stable release.\n3. Apply the update across all active Filer instances in the cluster.\n4. Verify JWT configuration and trailing slashes for existing clients.\n\n## References\n\n- [GitHub Security Advisory GHSA-gv5w-hfx8-8cwq](https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-gv5w-hfx8-8cwq)\n- [Fix Commit](https://github.com/seaweedfs/seaweedfs/commit/05ed5c9ae8a2a45101b52b61d02f170d20d587ff)\n- [Pull Request #9439](https://github.com/seaweedfs/seaweedfs/pull/9439)\n- [SeaweedFS Release 4.24](https://github.com/seaweedfs/seaweedfs/releases/tag/4.24)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-72921)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-72921)\n- [Wiz Vulnerability Database Reference](https://www.wiz.io/vulnerability-database/cve/cve-2026-72921)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72921) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T06:33:08.652835Z"}