High
SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
Type: advisorySources: OSV
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-72921
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 06:20 UTC · Revision 1
Source evidence
SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
core-osv · Original sourcePublished 11 Aug 2026, 14:28 UTC
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.
osv:CVE-2026-72921
Complete source record
{
"id": "c05b445127d27729d1960ac8424df82d5f938e97e443c07031770e9cf8d5d30a",
"url": "https://osv.dev/vulnerability/CVE-2026-72921",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths",
"summary": "SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24.",
"evidence": "osv:CVE-2026-72921",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-72921",
"aliases": [
"BIT-seaweedfs-2026-72921",
"CVE-2026-72921",
"GHSA-gv5w-hfx8-8cwq",
"GO-2026-6361"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/seaweedfs/seaweedfs",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "4bac9985b4a02af8e8df22454cdf63de2a247b49"
},
{
"fixed": "05ed5c9ae8a2a45101b52b61d02f170d20d587ff"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "4.24"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "05ed5c9ae8a2a45101b52b61d02f170d20d587ff"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "4bac9985b4a02af8e8df22454cdf63de2a247b49"
}
],
"source": "REFERENCES_TAG",
"original_tag": "4.24"
}
]
}
}
],
"versions": [
"4.23",
"4.22",
"4.21",
"4.20",
"4.19",
"4.18",
"4.17",
"4.16",
"4.15",
"4.13",
"4.12",
"4.09",
"4.08",
"4.07",
"4.06",
"4.05",
"4.04",
"4.03",
"4.02",
"4.01",
"4.00",
"3.99",
"3.97",
"3.96",
"3.95",
"3.94",
"3.93",
"3.92",
"3.91",
"3.90",
"3.89",
"3.88",
"3.87",
"3.86",
"3.85",
"3.84",
"3.83",
"3.82",
"3.81",
"3.80",
"3.79",
"3.78",
"3.77",
"3.76",
"3.75",
"3.74",
"3.73",
"3.72",
"3.67",
"3.66",
"3.64",
"3.63",
"3.62",
"3.61",
"3.60",
"3.59",
"3.58",
"3.57",
"3.55",
"3.54",
"3.53",
"3.52",
"3.51",
"3.50",
"3.48",
"3.47",
"3.46",
"3.45",
"3.44",
"3.43",
"3.42",
"3.41",
"3.40",
"3.39",
"3.38",
"3.37",
"3.36",
"3.35",
"3.34",
"3.33",
"v3.33",
"3.32",
"3.31",
"3.30",
"3.29",
"3.28",
"3.27",
"3.26",
"3.25",
"3.24",
"3.23",
"3.22",
"3.21",
"3.20",
"3.19",
"3.18",
"3.16",
"3.15",
"dev",
"3.14",
"3.13",
"3.12",
"3.11",
"3.10",
"3.09",
"3.08",
"3.07",
"3.06",
"3.05",
"3.04",
"3.03",
"3.02",
"3.01",
"3.00",
"2.99",
"2.98",
"2.97",
"2.96",
"2.95",
"2.94",
"2.93",
"2.92",
"2.91",
"2.90",
"2.89",
"2.88",
"2.87",
"2.86",
"2.85",
"2.84",
"2.83",
"2.82",
"2.80",
"2.81",
"2.79",
"2.78",
"2.77",
"2.76",
"2.75",
"2.74",
"2.73",
"2.72",
"2.71",
"2.70",
"2.69",
"2.68",
"2.67",
"2.66",
"2.65",
"2.64",
"2.63",
"2.62",
"2.61",
"2.60",
"2.59",
"2.58",
"2.57",
"2.56",
"2.55",
"2.54",
"2.53",
"2.52",
"2.51",
"2.50",
"2.49",
"2.48",
"2.47",
"2.43",
"2.42",
"2.41",
"2.40",
"2.39",
"2.38",
"2.37",
"2.36",
"2.35",
"2.34",
"2.33",
"2.32",
"2.31",
"2.30",
"2.29",
"2.28",
"2.27",
"2.26",
"2.25",
"2.24",
"2.23",
"2.22",
"2.21",
"2.19",
"2.20",
"2.18",
"2.17",
"2.16",
"2.15",
"2.14",
"2.13",
"2.12",
"2.11",
"2.10",
"2.09",
"2.08",
"2.07",
"2.06",
"2.05",
"2.04",
"2.03",
"2.02",
"2.01",
"2.00",
"1.99",
"1.98",
"1.97",
"1.96",
"1.95",
"1.94",
"1.93",
"1.92",
"1.91",
"1.90",
"1.88",
"1.87",
"1.86",
"1.85",
"1.84",
"1.83",
"1.82",
"1.81",
"1.80",
"1.79",
"1.78",
"1.77",
"1.76",
"1.75",
"1.71",
"1.74",
"1.73",
"1.72",
"1;70",
"1.70",
"1.69",
"1.68",
"1.67",
"1.66",
"1.65",
"1.64",
"1.63",
"1.62",
"1.61",
"1.61RC",
"1.45",
"1.60",
"1.59",
"1.58",
"1.57",
"1.56",
"1.55",
"1.54",
"1.53",
"1.52",
"1.51",
"1.50",
"1.49",
"1.48",
"1.47",
"1.46",
"1.44",
"1.43",
"1.42",
"1.41",
"1.40",
"1.38",
"1.37",
"1.36",
"1.35",
"1.33",
"1.32",
"1.31",
"1.30",
"1.29",
"1.28",
"1.27",
"1.26",
"1.25",
"1.24",
"1.23",
"1.22",
"1.21",
"1.20",
"1.19",
"1.18",
"1.17",
"1.16",
"1.15",
"1.14",
"1.12",
"1.11",
"1.10",
"1.09",
"1.08",
"1.07",
"1.06",
"1.05",
"1.04",
"1.03",
"1.02",
"1.01",
"1.00",
"0.99",
"0.98",
"0.97",
"0.96",
"0.95",
"0.94",
"0.93",
"0.92",
"0.91",
"0.90",
"0.77",
"0.76",
"0.75",
"0.74",
"0.73",
"0.72.release",
"0.72",
"v0.70beta",
"v0.69"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72921.json"
}
}
],
"modified": "2026-10-28T02:30:26.156129095Z",
"provider": "osv",
"references": [
"https://github.com/seaweedfs/seaweedfs/releases/tag/4.24",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72921.json",
"https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-gv5w-hfx8-8cwq",
"https://nvd.nist.gov/vuln/detail/CVE-2026-72921",
"https://github.com/seaweedfs/seaweedfs/commit/05ed5c9ae8a2a45101b52b61d02f170d20d587ff",
"https://github.com/seaweedfs/seaweedfs/pull/9439"
],
"provider_metadata": {
"cwe_ids": [
"CWE-863"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72921.json"
}
},
"related_cves": [
{
"value": "CVE-2026-72921",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 492952,
"published_at": "2026-08-11T14:28:49.398+00:00"
}