CVE-2026-77298 seaweedfs CVE debrief

Who should care

Defenders and administrators of SeaweedFS instances, especially those using OIDC JWT for authentication and federated users, should assess exposure and prioritize mitigation. This includes operators managing SeaweedFS deployments, platform administrators responsible for patch management, vulnerability management teams evaluating the impact of this issue, and security teams monitoring for potential unauthorized access.

Why it matters

CVE-2026-77298 is a high-severity vulnerability in SeaweedFS that allows unauthorized role assumption via OIDC JWT, potentially leading to unauthorized S3 access. Defenders should prioritize upgrading to version 4.40 or later and review federated users' access policies.

• Potential unauthorized S3 access, including object read, write, and delete capabilities
• Role assumption by federated users without proper trust policy enforcement
• Bypass of standard STS AssumeRoleWithWebIdentity security checks

Technical summary

The vulnerability in SeaweedFS versions 4.39 and earlier allows an external OIDC JWT sent directly in the Authorization header to map to an IAM role without enforcing that role's trust policy. This enables a federated user to assume a role they are not permitted to hold, potentially gaining unauthorized S3 access. The standard STS AssumeRoleWithWebIdentity path rejects such a token when the role's trust policy does not trust the token's federated provider, but the direct S3 bearer path validates only the token itself and then authenticates as the mapped role and evaluates that role's attached S3 permissions. As a result, a valid OIDC user whose token would be denied the role through STS can obtain the role's S3

Defensive priority

Defenders should prioritize upgrading to SeaweedFS version 4.40 or later to mitigate this vulnerability. Federated users' access and role assumption policies should be reviewed, especially in environments using OIDC JWT for authentication.

Recommended defensive actions

• Upgrade to SeaweedFS version 4.40 or later
• Review and update federated users' access and role assumption policies
• Monitor S3 access and authentication logs for suspicious activity
• Confirm whether affected SeaweedFS instances exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. GitHub references offer additional context on the fix and advisory details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.