Vendor
SeaweedFS versions prior to 4.24 are vulnerable to unauthenticated SSRF via the VolumeServer.FetchAndWriteNeedle RPC, allowing attackers to access internal services and cloud metadata endpoints.