CVE-2026-55873 json
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
published 4mo ago modified 2mo ago also BIT-seaweedfs-2026-55873 , EUVD-2026-42286 , GHSA-hgpf-8634-g44c , GO-2026-6329
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
SeaweedFS is a distributed storage system. In versions 4.08 through 4.33, requests signed with SigV4 service s3tables are routed to the S3Tables management API where authorization collapses account-less S3 identities into the shared admin account and fails open, allowing an authenticated low-privileged S3 user to enumerate administrator-owned table bucket names and ARNs. This issue is fixed in version 4.34.
Patch / fix
- go github.com/seaweedfs/seaweedfs 0.0.0-20260614205536-b13463880c1f
- bitnami seaweedfs 4.34.0
- seaweedfs seaweedfs 4.34
- govulncheck-vulndb SLES 16.0, SLES for SAP applications 16.0 0.0.20260902T191204-160000.1.1
suse advisories SUSE-SU-2026:23692-1SUSE-SU-2026:23712-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260902T191204-160000.1.1
opensuse advisories openSUSE-SU-2026:21812-1
Is CVE-2026-55873 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4mo ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/seaweedfs/seaweedfs | >=0.0.0-20260128085517-09bb90e8dc16, <0.0.0-20260614205536-b13463880c1f |
0.0.0-20260614205536-b13463880c1f |
| bitnami | seaweedfs | <4.34.0 |
4.34.0 |
Affected products
- seaweedfs seaweedfs
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/seaweedfs/seaweedfs/pull/9961
web, patch
-
github.com
/seaweedfs/seaweedfs/commit/b13463880c1fa62e255c058a9228b63cc95b4b36
web, patch
-
github.com
/seaweedfs/seaweedfs/security/advisories/GHSA-hgpf-8634-g44c
web, advisory
-
github.com
/seaweedfs/seaweedfs/releases/tag/4.34
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-55873
advisory, web
-
github.com
/seaweedfs/seaweedfs
package
Sources
- CVE List CVE-2026-55873
- GitHub Advisory GHSA-hgpf-8634-g44c
- NVD CVE-2026-55873
- OSV BIT-seaweedfs-2026-55873
- OSV GO-2026-6329
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.