High severity8.1NVD Advisory· Published Aug 11, 2026· Updated Sep 9, 2026
CVE-2026-72921
CVE-2026-72921
Description
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/seaweedfs/seaweedfsGo | < 0.0.0-20260512171048-05ed5c9ae8a2 | 0.0.0-20260512171048-05ed5c9ae8a2 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-gv5w-hfx8-8cwqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-72921ghsaADVISORY
- github.com/seaweedfs/seaweedfs/commit/05ed5c9ae8a2a45101b52b61d02f170d20d587ffnvdWEB
- github.com/seaweedfs/seaweedfs/pull/9439nvdWEB
- github.com/seaweedfs/seaweedfs/releases/tag/4.24nvdWEB
- github.com/seaweedfs/seaweedfs/security/advisories/GHSA-gv5w-hfx8-8cwqnvdWEB
News mentions
0No linked articles in our index yet.