{"id":"CVE-2026-72921","aliases":["BIT-seaweedfs-2026-72921","GHSA-gv5w-hfx8-8cwq","GO-2026-6361"],"url":"https://o3.security/vulnerability/CVE-2026-72921","summary":"SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths","details":"### Impact\nWhen a filer JWT restricts a token to a set of path prefixes via `allowed_prefixes`, the authorization check used a literal byte-prefix match (`strings.HasPrefix`). A token scoped to `/tenant1` therefore also authorized requests to sibling paths such as `/tenant1234`, `/tenant1-old`, and `/tenant1backup`.\n\nIn a multi-tenant deployment this lets the holder of one tenant's token access another tenant's data. Because `allowed_prefixes` gates both read and write tokens, the impact covers cross-tenant reads and writes. A valid scoped token is required, so this is an authorization bypass rather than a fully unauthenticated flaw.\n\n### Affected component\n- `weed/server/filer_server_handlers.go` (JWT `allowed_prefixes` authorization check)\n\n### Patches\nFixed in **4.24**. The check now matches on `/`-separated path components after `path.Clean` normalisation, so `/tenant1` authorizes only `/tenant1` and its descendants — not `/tenant1234` or other sibling paths.\n\n### Workarounds\nWhere feasible, choose prefix names that are not string-prefixes of one another (e.g. keep a trailing separator convention). Upgrade to 4.24.\n\n### References\n- Reported by Kadir Arslan (https://github.com/KadirArslan)","published":"2026-08-11T14:28:49.398Z","modified":"2026-09-25T18:27:34.509030807Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/seaweedfs/seaweedfs","fixedVersion":"0.0.0-20260512171048-05ed5c9ae8a2"}],"fix":{"url":"https://github.com/seaweedfs/seaweedfs/commit/05ed5c9ae8a2a45101b52b61d02f170d20d587ff","label":"seaweedfs/seaweedfs@05ed5c9"},"references":[{"type":"WEB","url":"https://github.com/seaweedfs/seaweedfs/releases/tag/4.24"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72921.json"},{"type":"ADVISORY","url":"https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-gv5w-hfx8-8cwq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72921"},{"type":"FIX","url":"https://github.com/seaweedfs/seaweedfs/commit/05ed5c9ae8a2a45101b52b61d02f170d20d587ff"},{"type":"FIX","url":"https://github.com/seaweedfs/seaweedfs/pull/9439"},{"type":"PACKAGE","url":"https://github.com/seaweedfs/seaweedfs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-25T18:27:34.509030807Z"}}