The flaw is significant because the vulnerability persists even if standard JWT signing keys are configured for other administrative operations. In cloud-hosted deployments, this vulnerability facilitates the exfiltration of instance IAM credentials and allows for interaction with otherwise unexposed internal infrastructure. Attackers can read the response back from these targets, enabling complete information disclosure. The vulnerability was patched in version 4.24 by introducing mandatory admin authorization and a guarded dialer that restricts target IP ranges and prevents DNS-rebinding.

Impact

Successful exploitation allows for the exfiltration of sensitive cloud instance metadata, including IAM tokens, and unauthorized interaction with internal services restricted by network boundaries. This affects all SeaweedFS deployments, particularly those hosted in cloud environments (AWS, GCP, Azure) where the metadata service is reachable. The vulnerability requires network access to the volume server's gRPC plane, which is unauthenticated by default.

Recommendation

• Update all SeaweedFS instances to version 4.24 or later immediately to patch CVE-2026-73080.
• Implement network-level access control to restrict access to the SeaweedFS gRPC ports (default port 8080) to trusted IP addresses only, blocking direct internet exposure.
• Enable mTLS via security.toml to enforce transport layer authentication for all gRPC communication.
• Audit VPC flow logs or network logs for anomalous outbound connections originating from SeaweedFS volume servers to internal infrastructure or known cloud metadata endpoints.