What is CVE-2026-72921?
CVE-2026-72921 is an authorization bypass vulnerability in SeaweedFS versions prior to 4.24, where the filer server's allowed_prefixes check uses strings.HasPrefix on raw paths. A JWT scoped to /tenant1 incorrectly authorizes access to sibling paths like /tenant1234, potentially granting unauthorized cross-tenant access. Upgrading to version 4.24 or later is recommended.
Azərbaycanca: CVE-2026-72921 SeaweedFS-in 4.24 versiyasına qədər olan filer_server_handlers.go faylında avtorizasiya yoxlaması zəifliyidir. `allowed_prefixes` yoxlaması `strings.HasPrefix` istifadə etdiyi üçün `/tenant1` icazəsi olan JWT ilə `/tenant1234` kimi oxşar path-lərə giriş mümkündür. Bu, bir tenant-in digərinin məlumatlarına icazəsiz girişinə səbəb ola bilər, ona görə SeaweedFS-i 4.24 və ya daha yuxarı versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-863
FAQ2
What versions of SeaweedFS are affected by CVE-2026-72921?
This vulnerability affects all versions of SeaweedFS prior to version 4.24.
What is the root cause of CVE-2026-72921?
The root cause is that the `allowed_prefixes` check in `filer_server_handlers.go` uses the `strings.HasPrefix` function, which allows a JWT scoped to `/tenant1` to gain unauthorized access to sibling paths like `/tenant1234`.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.