GHSA-87fv-vqqr-m4jr

Source

https://github.com/advisories/GHSA-87fv-vqqr-m4jr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-87fv-vqqr-m4jr/GHSA-87fv-vqqr-m4jr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-87fv-vqqr-m4jr

Aliases

Downstream

MINI (2)

Published

2026-08-11T15:58:23Z

Modified

2026-08-18T15:11:03Z

Severity

9.3 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N CVSS Calculator

Summary

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

Details

Impact

VolumeServer.FetchAndWriteNeedle fetches a caller-supplied remote endpoint and writes the response into a needle. Before 4.24 this RPC performed no authentication and no validation of the target, so anyone able to reach a volume server's gRPC port could coerce the server into issuing requests to arbitrary hosts — including loopback, link-local, RFC 1918, and cloud metadata endpoints such as 169.254.169.254 — and read the response back. On cloud deployments this discloses instance metadata and IAM credentials, and can be used to reach otherwise-unexposed internal services (SSRF with response read-back).

The volume server gRPC plane is unauthenticated on a default deployment, so no credentials are required. Configuring the documented JWT signing keys does not close it, because that hardening does not apply to this RPC.

Affected component

weed/server/volume_grpc_remote.go (FetchAndWriteNeedle)
weed/remote_storage/s3/s3_storage_client.go

Patches

Fixed in 4.24. FetchAndWriteNeedle now requires admin authorization and refuses loopback / link-local / RFC 1918 / IMDS destinations through a guarded dialer that resolves the host itself and pins the resolved address for the duration of the request, defeating DNS-rebinding. The Rust volume server carries the equivalent endpoint validation.

Workarounds

Restrict volume server gRPC ports to trusted hosts via firewall / network policy, and enable mTLS via security.toml.

Database specific

{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-11T15:58:23Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

Affected packages

Go / github.com/seaweedfs/seaweedfs

Package

Name: github.com/seaweedfs/seaweedfs; View open source insights on deps.dev
Purl: pkg:golang/github.com/seaweedfs/seaweedfs

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20260512171120-69da20bdaec9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-87fv-vqqr-m4jr/GHSA-87fv-vqqr-m4jr.json"