SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets (CVE-2026-55873)

SeaweedFS routes requests signed with SigV4 service 's3tables' to the S3Tables management API. Due to improper authorization, account-less S3 identities were collapsed into a shared 'admin' account and the authorization check failed open. Consequently, a user with only ordinary S3 Read credentials but no S3Tables-specific permissions could invoke management operations like GET /buckets and enumerate administrator-owned table bucket inventory, including bucket names and ARNs. The same vulnerability affected the Iceberg REST catalog. This issue affects SeaweedFS versions >=4.08 and <4.34. The vulnerability was fixed in version 4.34 by requiring the ACTION_ADMIN capability for administrator status, removing the collapsed admin account logic, and eliminating the tautological ListTableBuckets gate. Related hardening was applied in subsequent commits.

An authenticated low-privileged S3 user can bypass intended authorization boundaries to access S3Tables management API operations. The confirmed impact is disclosure of administrator-owned table bucket inventory, including bucket names and ARNs. In multi-tenant or shared deployments, this information disclosure can reveal tenant naming conventions and operational structure, potentially aiding further reconnaissance or targeted attacks. There is no indication of data modification or denial of service impact.

A fix is available in SeaweedFS version 4.34 and later. Users should upgrade to version 4.34 or newer to remediate this vulnerability. There is no configuration workaround available. The vendor has hardened authorization checks to require explicit ACTION_ADMIN capability and removed insecure default allow behavior.