Threats tagged 'bit-seaweedfs-2026-100413'

SeaweedFS versions from 4.0.388 up to but not including 4.41.0 contain a hard-coded unencrypted Ed25519 SSH private host key in the SFTP Helm chart. This key could be presented by certain standalone SFTP Helm deployments under specific configuration conditions, allowing an attacker who can intercept or redirect client traffic to impersonate the SFTP server. This impersonation could expose password credentials or data sent to the rogue endpoint. The issue is fixed in version 4.41.0.