Cross-Tenant Authorization Flaw in SeaweedFS Distributed Storage System

CVE-2026-72921

What is CVE-2026-72921?

The SeaweedFS distributed storage system has a vulnerability in its authorization mechanism, particularly in versions prior to 4.24. The flaw arises from a lenient authorization check implemented with the strings.HasPrefix function. As a result, a JSON Web Token (JWT) scoped to a specific path—such as /tenant1—may inadvertently authorize access to other related paths like /tenant1234, /tenant1-old, or /tenant1backup. This misconfiguration enables potential cross-tenant reads and writes using a valid scoped token. Users are encouraged to upgrade to version 4.24 or later, where this vulnerability has been addressed. For more detailed information and recommended actions, please review the official advisory at SeaweedFS Security Advisory.

References