SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle (CVE-2026-73080)
SeaweedFS versions prior to 4.24 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the VolumeServer.FetchAndWriteNeedle RPC. This RPC fetches a caller-supplied remote endpoint and writes the response into a needle without authentication or target validation, allowing attackers with network access to the volume server's gRPC port to coerce requests to arbitrary internal or external hosts and read the responses. This includes sensitive cloud metadata endpoints that can disclose instance metadata and IAM credentials. The vulnerability is fixed in version 4.24 by requiring admin authorization and blocking requests to loopback, link-local, RFC 1918, and cloud metadata IPs. Workarounds include restricting access to the gRPC port and enabling mTLS.
AI Analysis
Technical Summary
The SeaweedFS VolumeServer.FetchAndWriteNeedle RPC prior to version 4.24 allows unauthenticated SSRF with response read-back. It fetches a remote endpoint specified by the caller and writes the response into a needle without authentication or validation of the target address. This enables attackers with network access to the volume server's gRPC port to make requests to arbitrary hosts, including internal IP ranges and cloud metadata services such as 169.254.169.254, potentially exposing sensitive instance metadata and IAM credentials. The vulnerability arises because the RPC does not authenticate callers and does not restrict or validate the target addresses, allowing DNS rebinding and SSRF attacks. The fix in version 4.24 adds admin authorization requirements and blocks requests to loopback, link-local, RFC 1918, and cloud metadata endpoints using a guarded dialer that resolves and pins the target IP. The Rust volume server has equivalent protections. Workarounds include firewall restrictions on the gRPC port and enabling mTLS via configuration.
Potential Impact
An unauthenticated attacker with network access to the SeaweedFS volume server's gRPC port can exploit this vulnerability to perform SSRF attacks with response read-back. This can disclose sensitive internal services and cloud instance metadata, including IAM credentials, leading to potential compromise of cloud resources. The vulnerability affects confidentiality (high impact) and integrity (low impact) but does not affect availability. The CVSS 3.1 score is 9.3 (critical), reflecting network attack vector, no privileges required, no user interaction, and high confidentiality impact with scope change.
Mitigation Recommendations
A patch is available in SeaweedFS version 4.24 that requires admin authorization for the FetchAndWriteNeedle RPC and blocks requests to loopback, link-local, RFC 1918, and cloud metadata endpoints. Users should upgrade to version 4.24 or later. Until patched, restrict access to the volume server's gRPC port to trusted hosts using firewall or network policies and enable mTLS via the security.toml configuration to mitigate unauthorized access. These workarounds reduce exposure but do not fully eliminate the risk without the official fix.
SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle (CVE-2026-73080)
Description
SeaweedFS versions prior to 4.24 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the VolumeServer.FetchAndWriteNeedle RPC. This RPC fetches a caller-supplied remote endpoint and writes the response into a needle without authentication or target validation, allowing attackers with network access to the volume server's gRPC port to coerce requests to arbitrary internal or external hosts and read the responses. This includes sensitive cloud metadata endpoints that can disclose instance metadata and IAM credentials. The vulnerability is fixed in version 4.24 by requiring admin authorization and blocking requests to loopback, link-local, RFC 1918, and cloud metadata IPs. Workarounds include restricting access to the gRPC port and enabling mTLS.
CVSS v3.1
Score 9.3critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The SeaweedFS VolumeServer.FetchAndWriteNeedle RPC prior to version 4.24 allows unauthenticated SSRF with response read-back. It fetches a remote endpoint specified by the caller and writes the response into a needle without authentication or validation of the target address. This enables attackers with network access to the volume server's gRPC port to make requests to arbitrary hosts, including internal IP ranges and cloud metadata services such as 169.254.169.254, potentially exposing sensitive instance metadata and IAM credentials. The vulnerability arises because the RPC does not authenticate callers and does not restrict or validate the target addresses, allowing DNS rebinding and SSRF attacks. The fix in version 4.24 adds admin authorization requirements and blocks requests to loopback, link-local, RFC 1918, and cloud metadata endpoints using a guarded dialer that resolves and pins the target IP. The Rust volume server has equivalent protections. Workarounds include firewall restrictions on the gRPC port and enabling mTLS via configuration.
Potential Impact
An unauthenticated attacker with network access to the SeaweedFS volume server's gRPC port can exploit this vulnerability to perform SSRF attacks with response read-back. This can disclose sensitive internal services and cloud instance metadata, including IAM credentials, leading to potential compromise of cloud resources. The vulnerability affects confidentiality (high impact) and integrity (low impact) but does not affect availability. The CVSS 3.1 score is 9.3 (critical), reflecting network attack vector, no privileges required, no user interaction, and high confidentiality impact with scope change.
Mitigation Recommendations
A patch is available in SeaweedFS version 4.24 that requires admin authorization for the FetchAndWriteNeedle RPC and blocks requests to loopback, link-local, RFC 1918, and cloud metadata endpoints. Users should upgrade to version 4.24 or later. Until patched, restrict access to the volume server's gRPC port to trusted hosts using firewall or network policies and enable mTLS via the security.toml configuration to mitigate unauthorized access. These workarounds reduce exposure but do not fully eliminate the risk without the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-87fv-vqqr-m4jr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-73080"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a7b6fc7bf8831d5393e995f
Added to database: 08/11/2026, 18:53:59 UTC
Last enriched: 08/11/2026, 18:57:34 UTC
Last updated: 08/12/2026, 00:59:00 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.