CVE-2026-72921: 
Wolfi vulnerability analysis and mitigation

CVE-2026-72921 is an authorization bypass vulnerability in SeaweedFS, a distributed storage system, caused by an incorrect path prefix matching logic in the filer JWT authorization check. All versions prior to 4.24 are affected. The flaw was reported by security researcher Kadir Arslan, disclosed via a GitHub Security Advisory on July 8, 2026, and published to NVD on August 11, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory).

The root cause is an incorrect authorization check (CWE-863) in weed/server/filer_server_handlers.go, where the allowed_prefixes validation used Go's strings.HasPrefix on raw URL path strings. This means a filer JWT token scoped to /tenant1 would also authorize access to sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, because those strings share the same byte-level prefix. The fix introduced a new pathHasComponentPrefix helper function that normalizes paths using path.Clean and enforces slash-boundary matching — requiring the path to equal the prefix exactly or be followed by a / separator — thereby preventing partial path segment collisions and path traversal bypasses (GitHub Advisory, Fix PR #9439).

An authenticated attacker holding a valid JWT token scoped to one tenant path can read and write data belonging to sibling tenants whose path names share the same string prefix, completely breaking multi-tenant isolation. Both read and write operations are affected since allowed_prefixes gates both token types. This could result in unauthorized disclosure of sensitive cross-tenant data (high confidentiality impact) and unauthorized modification or deletion of another tenant's stored files (high integrity impact), with no availability impact (GitHub Advisory).

Exploitation requires a valid, scoped filer JWT token — making this an authorization bypass rather than an unauthenticated attack. No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.0024 (0.24%), reflecting low near-term exploitation probability (GitHub Advisory, Feedly).

1. Obtain a scoped JWT token: Acquire a valid filer JWT token legitimately scoped to a specific tenant path, e.g., /tenant1. This could be a token issued to a legitimate tenant in a multi-tenant SeaweedFS deployment.
2. Identify sibling tenant paths: Enumerate or guess sibling tenant path names that share the same string prefix as the attacker's authorized path (e.g., /tenant1234, /tenant1-old, /tenant1backup).
3. Craft a malicious request: Construct an HTTP GET or PUT request targeting the sibling tenant's path (e.g., GET /tenant1234/sensitive-file) and include the attacker's JWT token in the Authorization header.
4. Bypass authorization: The vulnerable strings.HasPrefix check in filer_server_handlers.go evaluates /tenant1234 as matching the prefix /tenant1, granting access.
5. Read or write cross-tenant data: Successfully retrieve sensitive files from or write malicious data to the sibling tenant's storage namespace, achieving cross-tenant data exfiltration or tampering (GitHub Advisory, Fix PR #9439).

• Network: HTTP GET or PUT requests from a tenant's authenticated session targeting path prefixes outside their assigned namespace (e.g., a token scoped to /tenant1 making requests to /tenant1234/, /tenant1-old/, or /tenant1backup/).
• Logs: Filer access logs showing successful (HTTP 200/201) responses to cross-tenant paths using the same JWT token; requests to sibling paths that differ only by a numeric or alphanumeric suffix appended to a known tenant prefix.
• Behavioral: A single JWT token accessing multiple distinct tenant namespaces within a short time window; unusual read or write volume on tenant paths not associated with the token's expected scope.

Upgrade SeaweedFS to version 4.24 or later, which replaces the vulnerable strings.HasPrefix check with the path-component-aware pathHasComponentPrefix function (SeaweedFS Release 4.24). As a short-term workaround prior to upgrading, choose tenant prefix names that are not string-prefixes of one another — for example, by enforcing a trailing separator convention (e.g., /tenant1/ vs. /tenant2/) or using non-overlapping naming schemes. Additionally, audit all currently issued JWT scopes to identify any tokens that may have inadvertently authorized access to sibling paths, and review access logs for suspicious cross-tenant activity (GitHub Advisory).

The vulnerability was reported by independent researcher Kadir Arslan and acknowledged by SeaweedFS maintainer chrislusf, who merged the fix promptly via PR #9439 on May 12, 2026. The advisory was published on GitHub on July 8, 2026. Brief mentions appeared on Mastodon via TheHackerWire and were indexed by vulnerability aggregators including VulDB, Vulners, and INCIBE-CERT, but no significant broader media coverage or notable community debate has been observed (GitHub Advisory).