Session Hijacking Vulnerability in SeaweedFS Distributed Storage System

CVE-2026-77368

What is CVE-2026-77368?

In version 4.39 of SeaweedFS, a vulnerability exists where the TUS resumable-upload handler's JWT allowed_prefixes are only validated upon session creation. This oversight permits a low-privilege tenant to hijack upload sessions from other tenants, allowing them to write content to unauthorized paths. The attacker can exploit this flaw by obtaining another tenant's session identifier, enabling them to manipulate the files associated with it through HEAD, PATCH, and DELETE actions. This flaw ultimately undermines the JWT prefix isolation intended to secure tenant data. The issue is resolved in version 4.40, emphasizing the importance of updating to maintain data integrity and security.

References