CVE-2026-73080: 
Wolfi vulnerability analysis and mitigation

CVE-2026-73080 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in SeaweedFS, a distributed storage system, affecting all versions prior to 4.24. The flaw exists in the VolumeServer.FetchAndWriteNeedle RPC, which accepts a caller-supplied remote endpoint without authentication or target validation, allowing arbitrary outbound requests and response read-back. It was reported by Kadir Arslan, privately disclosed to the project on July 8, 2026, and publicly published to the GitHub Advisory Database on August 11, 2026. The vulnerability carries a CVSS v3.1 base score of 9.3 (Critical) (GitHub Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the FetchAndWriteNeedle RPC in weed/server/volume_grpc_remote.go accepts a caller-controlled S3 endpoint URL and passes it directly to weed/remote_storage/s3/s3_storage_client.go without any authentication check or destination validation. Because the volume server's gRPC plane is unauthenticated by default, any network-reachable attacker can invoke this RPC with an arbitrary target URL — including loopback addresses, link-local addresses (e.g., 169.254.169.254), RFC 1918 private ranges, and CGNAT ranges — and receive the full HTTP response. Notably, configuring JWT signing keys (the documented hardening mechanism) does not protect this RPC, as the JWT enforcement was not applied to FetchAndWriteNeedle. The attack also carries DNS-rebinding risk: a hostname could resolve to a public IP during any pre-check and then flip to an internal address at dial time (GitHub Advisory, Fix PR #9441).

An unauthenticated attacker with network access to a volume server's gRPC port can coerce the server into issuing HTTP/HTTPS requests to any host reachable from the server and read the full response. On cloud deployments, this directly enables disclosure of instance metadata and IAM credentials via the IMDS endpoint (169.254.169.254), which can be leveraged for lateral movement, privilege escalation, or full cloud account compromise. The vulnerability also allows access to otherwise-firewalled internal services, expanding the blast radius beyond the SeaweedFS cluster itself. Integrity impact is rated Low (the response is written into a needle), and availability is not directly affected (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of publication (GitHub Advisory). The EPSS score is reported as 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and no user interaction, and the gRPC port is unauthenticated by default, making exploitation trivially easy for any attacker with network access to the port.

1. Reconnaissance: Identify internet-facing or network-accessible SeaweedFS volume servers running versions prior to 4.24 using tools like Shodan, Censys, or internal network scanning. The default gRPC port for volume servers is typically 18080.
2. Confirm gRPC access: Verify that the volume server's gRPC port is reachable and unauthenticated using a gRPC client tool (e.g., grpcurl) to list available services on the target.
3. Craft malicious RPC call: Invoke the VolumeServer.FetchAndWriteNeedle RPC with a RemoteConf message specifying a malicious S3Endpoint value targeting the cloud IMDS endpoint, e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/ or an internal service URL.
4. Retrieve response: The volume server fetches the target URL and writes the response body into a needle. The attacker reads the needle content to obtain the IMDS response, which includes IAM role credentials (AccessKeyId, SecretAccessKey, SessionToken).
5. Leverage credentials: Use the harvested IAM credentials to authenticate to AWS APIs and perform lateral movement, data exfiltration, or privilege escalation within the cloud environment (GitHub Advisory, Fix PR #9441).

• Network: Unexpected outbound HTTP/HTTPS connections from the SeaweedFS volume server process to 169.254.169.254, metadata.google.internal, RFC 1918 addresses, or other internal hosts not part of normal S3 remote storage operations.
• Network: Inbound gRPC connections to the volume server port (default 18080) from unexpected or external source IPs, especially without mTLS.
• Logs: Volume server logs showing FetchAndWriteNeedle RPC invocations with unusual or internal S3Endpoint values in the RemoteConf field.
• Logs: HTTP requests in access logs or network captures from the volume server to IMDS endpoints or internal service URLs.
• File System: Unexpected needle files written to volume data directories containing content consistent with HTTP responses (e.g., JSON-formatted IAM credential blobs) rather than legitimate user data.

Upgrade SeaweedFS to version 4.24 or later immediately; the fix gates FetchAndWriteNeedle behind checkGrpcAdminAuth and adds a guarded dialer that blocks loopback, link-local, RFC 1918, CGNAT, and IMDS destinations, with DNS-rebinding protection (SeaweedFS Release 4.24). If immediate patching is not possible, restrict network access to the volume server's gRPC port to trusted clients only using firewall rules or network policy, and enable mTLS via security.toml. Note that configuring JWT signing keys alone does not mitigate this vulnerability on unpatched versions. Operators who legitimately need to fetch from private S3-compatible hosts after upgrading can use the new -volume.allowUntrustedRemoteEndpoints flag, but this should be used with caution (GitHub Advisory).

The vulnerability was credited to researcher Kadir Arslan, who reported it to the SeaweedFS project. The fix was authored by project maintainer chrislusf and merged on May 12, 2026, with the advisory published publicly on August 11, 2026. The issue was noted in the Go vulnerability database (golang/vulndb#6219) and tracked by security tooling including Tenable container security plugins and INCIBE-CERT. Social media coverage was limited, with a brief mention on Mastodon via @thehackerwire (GitHub Advisory).