{"vulnerability": "CVE-2026-7292", "sightings": [{"uuid": "cb1e018f-4918-4ad1-bba3-fe3283b31a02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7292", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mklgendiy32c", "content": "", "creation_timestamp": "2026-04-28T20:29:08.426096Z"}, {"uuid": "34a93a6f-bf2c-490f-a4ea-7c133ac44c0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72920", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msswmmctyv2o", "content": "CVE-2026-72920 - seaweedfs\nSeaweedFS, a distributed storage system, has a security issue that allows unauthorized users to gain full control over S3 settings. This could lead to data being deleted or modified\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#seaweedfs #CVE #infosec", "creation_timestamp": "2026-08-11T15:30:05.737905Z"}, {"uuid": "e58d3fab-c9a7-4639-ab9e-594190a9a059", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72920", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mssyf7mxot2u", "content": "\ud83d\udd34 CVE-2026-72920 - Critical (9.8)\n\nSeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentity...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-72920/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-11T16:01:45.980599Z"}, {"uuid": "321827e3-8e67-4c83-92c6-d78276861fbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72921", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mssyfgmc6w24", "content": "\ud83d\udfe0 CVE-2026-72921 - High (8.1)\n\nSeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.g...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-72921/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-11T16:01:53.936883Z"}, {"uuid": "a79c6cd5-ee7c-4465-a559-44dae1ffa9da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72922", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mssyfnlohy2t", "content": "\ud83d\udfe0 CVE-2026-72922 - High (8.2)\n\nAutoGPT is a workflow automation platform for creating, deploying, and managing continuous artifi...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-72922/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-11T16:02:00.572429Z"}, {"uuid": "818ea670-a3fb-4fcb-b261-24f798532502", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72921", "type": "seen", "source": "https://gist.github.com/alon710/973db52eb7701f6319f995cd1192baf0", "content": "# CVE-2026-72921: CVE-2026-72921: Incorrect Authorization in SeaweedFS Filer JWT Prefix Match\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72921\n\n## Summary\nSeaweedFS is a distributed storage system. Prior to version 4.24, the Filer JWT validation mechanism used a raw prefix match, allowing scoped tokens to access sibling directories sharing similar name prefixes.\n\n## TL;DR\nSeaweedFS Filer prior to 4.24 uses raw prefix matching on raw path strings during JWT validation, allowing scoped tokens to authorize unauthorized access to sibling directories (e.g., /tenant1 matching /tenant1234).\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.1 (High)\n- **EPSS Score**: 0.00238 (0.24%)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SeaweedFS Filer\n- Wolfi\n- Chainguard\n- **SeaweedFS**: < 4.24 (Fixed in: `4.24`)\n\n## Mitigation\n\n- Upgrade SeaweedFS to version 4.24 or later to enforce component-aware path authorization.\n- Refactor tenant namespace directories to prevent overlapping suffix names.\n- Enforce trailing slashes on all scoped JWT AllowedPrefixes claims.\n\n**Remediation Steps:**\n1. Identify current SeaweedFS Filer version.\n2. Download SeaweedFS 4.24 or a later stable release.\n3. Apply the update across all active Filer instances in the cluster.\n4. Verify JWT configuration and trailing slashes for existing clients.\n\n## References\n\n- [GitHub Security Advisory GHSA-gv5w-hfx8-8cwq](https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-gv5w-hfx8-8cwq)\n- [Fix Commit](https://github.com/seaweedfs/seaweedfs/commit/05ed5c9ae8a2a45101b52b61d02f170d20d587ff)\n- [Pull Request #9439](https://github.com/seaweedfs/seaweedfs/pull/9439)\n- [SeaweedFS Release 4.24](https://github.com/seaweedfs/seaweedfs/releases/tag/4.24)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-72921)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-72921)\n- [Wiz Vulnerability Database Reference](https://www.wiz.io/vulnerability-database/cve/cve-2026-72921)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72921) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T06:33:08.652835Z"}]}