Unauthenticated SSRF in SeaweedFS VolumeServer.FetchAndWriteNeedle

SeaweedFS versions prior to 4.24 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability within the VolumeServer.FetchAndWriteNeedle RPC endpoint. This endpoint, intended to fetch and write data into a needle, performs no authentication and lacks validation of the requested target host. An attacker with network access to the gRPC port can coerce the volume server to issue requests to arbitrary targets, including loopback addresses, RFC 1918 private IP ranges, and cloud metadata services (e.g., 169.254.169.254).

The flaw is significant because the vulnerability persists even if standard JWT signing keys are configured for other administrative operations. In cloud-hosted deployments, this vulnerability facilitates the exfiltration of instance IAM credentials and allows for interaction with otherwise unexposed internal infrastructure. Attackers can read the response back from these targets, enabling complete information disclosure. The vulnerability was patched in version 4.24 by introducing mandatory admin authorization and a guarded dialer that restricts target IP ranges and prevents DNS-rebinding.

Impact

Successful exploitation allows for the exfiltration of sensitive cloud instance metadata, including IAM tokens, and unauthorized interaction with internal services restricted by network boundaries. This affects all SeaweedFS deployments, particularly those hosted in cloud environments (AWS, GCP, Azure) where the metadata service is reachable. The vulnerability requires network access to the volume server's gRPC plane, which is unauthenticated by default.

Recommendation

• Update all SeaweedFS instances to version 4.24 or later immediately to patch CVE-2026-73080.
• Implement network-level access control to restrict access to the SeaweedFS gRPC ports (default port 8080) to trusted IP addresses only, blocking direct internet exposure.
• Enable mTLS via security.toml to enforce transport layer authentication for all gRPC communication.
• Audit VPC flow logs or network logs for anomalous outbound connections originating from SeaweedFS volume servers to internal infrastructure or known cloud metadata endpoints.