CVE-2026-77368 seaweedfs CVE debrief

Who should care

Defenders responsible for SeaweedFS deployments, particularly those using version 4.39 with TUS uploads enabled and filer JWT signing configured, should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

CVE-2026-77368 is a high-severity vulnerability in SeaweedFS that allows unauthorized actions via TUS upload session hijacking. Defenders should verify and upgrade to version 4.40 if necessary, review TUS upload and filer configurations, and monitor for suspicious activity.

• Potential unauthorized data writes to filer paths.
• Possible deletion or reading of other tenants' upload sessions.
• Bypass of JWT prefix isolation for TUS uploads.
• Verification of TUS upload sessions and filer configurations is necessary.

Technical summary

The vulnerability in SeaweedFS version 4.39 allows a low-privilege tenant to hijack another tenant's TUS upload session. This can lead to unauthorized writing of content to filer paths that the tenant's token forbids. The issue arises because the filer's TUS resumable-upload handler only checks JWT allowed_prefixes when a session is created. Subsequent actions on the session, such as HEAD, PATCH, and DELETE requests, do not verify that the session's target path falls within the caller's allowed prefixes. This can result in a tenant writing to paths they should not have access to, or deleting or reading upload progress of other tenants' sessions.

Defensive priority

Defenders should prioritize verifying and upgrading to version 4.40 if using SeaweedFS version 4.39 with TUS uploads enabled and filer JWT signing configured.

Recommended defensive actions

• Verify the SeaweedFS version and configuration to determine if exposure exists.
• Upgrade to version 4.40 or later if using version 4.39 with TUS uploads enabled and filer JWT signing configured.
• Review and restrict TUS upload sessions and filer JWT signing configurations to minimize potential impact.
• Monitor for suspicious activity related to TUS uploads and filer interactions.
• Perform vulnerability scanning to identify potentially exposed assets.
• Implement additional logging and monitoring for TUS upload and filer interactions.
• Review access controls and permissions for TUS upload sessions.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in SeaweedFS version 4.39. The vulnerability allows a low-privilege tenant to hijack another tenant's upload session, write content to forbidden filer paths, and perform other unauthorized actions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.