CVE-2026-77611 seaweedfs CVE debrief

Who should care

Defenders managing SeaweedFS deployments, S3 administrators, and security teams responsible for monitoring and enforcing data access controls should assess exposure and verify remediation.

Why it matters

CVE-2026-77611 allows authenticated S3 principals to overwrite unauthorized objects in SeaweedFS, potentially leading to data corruption and exposure. Defenders should verify their deployments, restrict S3 principal permissions, and monitor ACL configurations to mitigate this vulnerability.

• Data overwrite and corruption due to flawed ACL handling
• Unauthorized data modification by authenticated S3 principals
• Bypassing of object-level access controls
• Potential for sensitive data exposure or loss

Technical summary

The vulnerability in SeaweedFS versions prior to 4.40 allows an authenticated S3 principal with permissions to a nested object key to overwrite a different object outside that scope. This is achieved by calling PutObjectAcl on the key the principal is allowed to access, which updates the ACL entry at the bucket root instead of the object's actual parent directory. Consequently, the content, metadata, owner information, and ACL of the scoped object are written to the target object, bypassing the object-level action scoping.

Defensive priority

Defenders should prioritize verifying their SeaweedFS deployments for version 4.40 or later, reviewing object ACL configurations, and restricting S3 principal permissions to the minimum required scope.

Recommended defensive actions

• Verify SeaweedFS version and upgrade to 4.40 or later if necessary
• Review and restrict S3 principal permissions to minimum required scope
• Monitor object ACL configurations for unauthorized changes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. Additional information is available in the referenced GitHub advisory and commit. Defenders should verify their SeaweedFS deployments for version 4.40 or later, review object ACL configurations, and restrict S3 principal permissions to the minimum required scope. This includes checking relevant monitoring, detection, and logs for exposed assets that need extra review.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.