CVE-2026-55873

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55873
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55873.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55873
Aliases
Downstream
Related
Published
2026-07-08T14:48:37Z
Modified
2026-09-10T18:26:46Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
Details

SeaweedFS is a distributed storage system. In versions 4.08 through 4.33, requests signed with SigV4 service s3tables are routed to the S3Tables management API where authorization collapses account-less S3 identities into the shared admin account and fails open, allowing an authenticated low-privileged S3 user to enumerate administrator-owned table bucket names and ARNs. This issue is fixed in version 4.34.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55873.json"
}
References

Affected packages

Git / github.com/seaweedfs/seaweedfs

Affected ranges

Type
GIT
Repo
https://github.com/seaweedfs/seaweedfs
Events
Introduced
330bd92ddce763649d07e078d550cb03eda6a593
Fixed
c6cf5a5bd7c87694c8d71ab41571f1412170ab2a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "4.08"
        },
        {
            "fixed": "4.34"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

4.*
4.08
4.09
4.12
4.13
4.15
4.16
4.17
4.18
4.19
4.20
4.21
4.22
4.23
4.24
4.25
4.26
4.27
4.28
4.29
4.30
4.31
4.32
4.33

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55873.json"