{"id":"CVE-2026-55873","aliases":["BIT-seaweedfs-2026-55873","GHSA-hgpf-8634-g44c","GO-2026-6329"],"url":"https://o3.security/vulnerability/CVE-2026-55873","summary":"SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets","details":"### Summary\nSeaweedFS routes requests signed with SigV4 service `s3tables` to the S3Tables\nmanagement API. Authorization on that path collapsed account-less S3 identities\ninto the shared `admin` account and failed open, so a user holding only ordinary\nS3 `Read` credentials — and no S3Tables-specific permission — could invoke\nS3Tables management operations such as `GET /buckets` and enumerate\nadministrator-owned table bucket inventory (names and ARNs). The same handler\nbacks the Iceberg REST catalog, which was affected by the same flaw.\n\n### Impact\nAn authenticated low-privileged S3 user can cross the boundary between ordinary\nS3 object access and S3Tables management. Confirmed impact is disclosure of\nadministrator-owned table bucket inventory (bucket names and ARNs); in shared or\nmulti-tenant deployments this can reveal tenant naming and operational structure.\n\n### Affected versions\nSeaweedFS `>= 4.08, < 4.34` (the S3Tables management API was introduced in 4.08).\n\n### Patched versions\nFixed in **4.34** (#9961). Administrator status is now decided by the\n`ACTION_ADMIN` capability rather than by a collapsed `admin` account id, S3Tables\nauthorization no longer defaults to allow, and the tautological ListTableBuckets\ngate was removed. Related hardening of the same root cause landed in #9962,\n#9963, and #9971.\n\n### Workaround\nNo configuration workaround — upgrade to 4.34 or later.\n\n### Credit\nReported by **TA-MU-TA**.","published":"2026-07-08T14:48:37Z","modified":"2026-09-29T18:26:47.024072216Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"epss":{"score":0.00342,"percentile":0.27658,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/seaweedfs/seaweedfs","fixedVersion":"0.0.0-20260614205536-b13463880c1f"}],"fix":{"url":"https://github.com/seaweedfs/seaweedfs/commit/b13463880c1fa62e255c058a9228b63cc95b4b36","label":"seaweedfs/seaweedfs@b134638"},"references":[{"type":"WEB","url":"https://github.com/seaweedfs/seaweedfs/releases/tag/4.34"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55873.json"},{"type":"ADVISORY","url":"https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-hgpf-8634-g44c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55873"},{"type":"FIX","url":"https://github.com/seaweedfs/seaweedfs/commit/b13463880c1fa62e255c058a9228b63cc95b4b36"},{"type":"FIX","url":"https://github.com/seaweedfs/seaweedfs/pull/9961"},{"type":"PACKAGE","url":"https://github.com/seaweedfs/seaweedfs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-29T18:26:47.024072216Z"}}