https://vulnerability.circl.lu/sightings/feed 2026-08-13T23:31:44.135023+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/50739264-e418-4b37-8626-b7da8c45ed34/export 2026-08-13T23:31:44.150741+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "50739264-e418-4b37-8626-b7da8c45ed34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-87fv-vqqr-m4jr", "type": "seen", "source": "https://gist.github.com/alon710/6fa389a21aaf392bd94e8f902ff02560", "content": "# CVE-2026-73080: CVE-2026-73080: Unauthenticated Server-Side Request Forgery (SSRF) in SeaweedFS Volume Server\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-08-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73080\n\n## Summary\nA critical-severity Server-Side Request Forgery (SSRF) vulnerability exists in SeaweedFS volume servers prior to version 4.24. Unauthenticated attackers can trigger arbitrary HTTP requests to internal networks and cloud metadata services via the gRPC endpoint and retrieve the response data.\n\n## TL;DR\nUnauthenticated remote attackers can abuse a gRPC endpoint in SeaweedFS to perform full-read Server-Side Request Forgery (SSRF), exposing internal services and cloud instance metadata.\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS Score**: 9.3\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SeaweedFS Volume Server\n- **SeaweedFS**: < 4.24 (Fixed in: `4.24`)\n\n## Mitigation\n\n- Upgrade SeaweedFS to version 4.24 or higher\n- Restrict gRPC ports (e.g., 18080) to trusted cluster members\n- Ensure -volume.allowUntrustedRemoteEndpoints is not enabled\n- Enforce IMDSv2 with a hop limit of 1 on cloud instances\n\n**Remediation Steps:**\n1. Identify all running instances of SeaweedFS Volume Servers.\n2. Update the SeaweedFS binaries or container images to version 4.24 or higher.\n3. Verify that the startup flags do not contain -volume.allowUntrustedRemoteEndpoints.\n4. Apply firewall rules or security group policies to block public gRPC access.\n5. Monitor gRPC traffic for unauthorized FetchAndWriteNeedle calls.\n\n## References\n\n- [GitHub Security Advisory GHSA-87fv-vqqr-m4jr](https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-87fv-vqqr-m4jr)\n- [SeaweedFS Pull Request #9441](https://github.com/seaweedfs/seaweedfs/pull/9441)\n- [Fix Commit 69da20bdaec923e5a43d8aa71bf3c0a2051fc019](https://github.com/seaweedfs/seaweedfs/commit/69da20bdaec923e5a43d8aa71bf3c0a2051fc019)\n- [SeaweedFS Release 4.24](https://github.com/seaweedfs/seaweedfs/releases/tag/4.24)\n- [CVE-2026-73080 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-73080)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73080) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-11T16:32:22.060112Z"} 2026-08-11T16:32:22.060112+00:00