CVE-2026-58372 seaweedfs CVE debrief

Who should care

Defenders responsible for SeaweedFS deployments, S3 bucket administrators, and security teams should assess exposure and prioritize remediation. They should verify the SeaweedFS version, restrict write access to S3 buckets, and monitor S3 bucket activity for unauthorized object deletions. Additionally, they should review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

CVE-2026-58372 is a high-severity vulnerability in SeaweedFS that allows authenticated users to delete objects across buckets, potentially leading to data loss or corruption. Defenders should prioritize verification and remediation.

• Potential unauthorized deletion of objects across S3 buckets
• Bypass of authorization controls through confused deputy condition
• Possible data loss or corruption due to arbitrary object deletion
• Need for verification of SeaweedFS version and exposure

Technical summary

The vulnerability is caused by a path traversal issue in the DeleteMultipleObjectsHandler of the S3 gateway in SeaweedFS. This allows an authenticated S3 principal with write access to a single bucket to delete objects in other buckets by providing object keys with ../ sequences in the DeleteObjects XML request body. The validateRequestPath middleware only inspects URL-captured path variables and never examines request-body keys, enabling the filer path to collapse directory traversal sequences and resolve deletions outside the authorized bucket.

Defensive priority

Defenders should prioritize verifying and upgrading to SeaweedFS version 4.34 or later to prevent unauthorized object deletion across buckets.

Recommended defensive actions

• Verify SeaweedFS version and upgrade to 4.34 or later if necessary
• Restrict write access to S3 buckets to only required users and roles
• Monitor S3 bucket activity for unauthorized object deletions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in SeaweedFS versions before 4.34. The CVE Program and NVD provide official records of the vulnerability. Evidence is based on the official CVE record and NVD vulnerability detail. Defenders should verify the SeaweedFS version and assess exposure. The CVE Program and NVD provide official records of the vulnerability, but additional details may be limited. Further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.