Answer in brief
CVE-2026-73080 records a Critical severity (CVSS 9.3) vulnerability in SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle. The current sources do not mark it as known exploited. The current feed maps seaweedfs/seaweedfs (generic), github.com/seaweedfs/seaweedfs (go), github.com/seaweedfs/seaweedfs (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-73080 records a Critical severity (CVSS 9.3) vulnerability in SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle. The current sources do not mark it as known exploited. The current feed maps seaweedfs/seaweedfs (generic), github.com/seaweedfs/seaweedfs (go), github.com/seaweedfs/seaweedfs (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps seaweedfs/seaweedfs (generic), github.com/seaweedfs/seaweedfs (go), github.com/seaweedfs/seaweedfs (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| seaweedfs/seaweedfsgeneric | < 4.24 | Not reported |
| github.com/seaweedfs/seaweedfsgo | <0.0.0-20260512171120-69da20bdaec9 | 0.0.0-20260512171120-69da20bdaec9 |
| github.com/seaweedfs/seaweedfsgo | >=0 <0.0.0-20260512171120-69da20bdaec9 | 0.0.0-20260512171120-69da20bdaec9 |
Published upstream
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the response into a needle. The RPC performs no authentication and no target validation, allowing anyone who can reach a volume server's gRPC port to cause requests to arbitrary hosts, including loopback, link-local, RFC 1918, and cloud metadata endpoints such as 169.254.169.254, and read the response. On cloud deployments, this can disclose instance metadata and IAM credentials and reach otherwise unexposed internal services. The volume server gRPC plane is unauthenticated by default, and configuring documented JWT signing keys does not protect this RPC. This issue is fixed in version 4.24.
Quoted source text, attributed separately from HOL analysis.
CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps seaweedfs/seaweedfs (generic), github.com/seaweedfs/seaweedfs (go), github.com/seaweedfs/seaweedfs (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| seaweedfs/seaweedfsgeneric | < 4.24 | Not reported |
| github.com/seaweedfs/seaweedfsgo | <0.0.0-20260512171120-69da20bdaec9 | 0.0.0-20260512171120-69da20bdaec9 |
| github.com/seaweedfs/seaweedfsgo | >=0 <0.0.0-20260512171120-69da20bdaec9 | 0.0.0-20260512171120-69da20bdaec9 |
Published upstream
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the response into a needle. The RPC performs no authentication and no target validation, allowing anyone who can reach a volume server's gRPC port to cause requests to arbitrary hosts, including loopback, link-local, RFC 1918, and cloud metadata endpoints such as 169.254.169.254, and read the response. On cloud deployments, this can disclose instance metadata and IAM credentials and reach otherwise unexposed internal services. The volume server gRPC plane is unauthenticated by default, and configuring documented JWT signing keys does not protect this RPC. This issue is fixed in version 4.24.
Quoted source text, attributed separately from HOL analysis.