Security Flaw in SeaweedFS Distributed Storage System Affecting SFTP Deployment

CVE-2026-100413

What is CVE-2026-100413?

An unencrypted Ed25519 private host key in the SFTP Helm chart of SeaweedFS allows attackers to impersonate the SFTP endpoint. This vulnerability, present in versions from 4.0.388 to 4.41, can lead to compromised password credentials and sensitive data exposure when clients trust the published host identity. The issue arises when specific configurations are met, allowing unauthorized interception of client traffic. Users are encouraged to upgrade to version 4.41, which addresses this security concern.

References