CVE-2026-100413

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfs_sftp_ssh_private_key. A standalone deployment presented that public key when sftp.enabled and sftp.enableAuth were true, sftp.existingConfigSecret was not supplied, the legacy sftp.sshPrivateKey path remained selected, a valid config-ssh Secret allowed startup, and hostKeysFolder did not provide a later Ed25519 signer. An attacker able to redirect or intercept client traffic could impersonate that SFTP endpoint to clients that trusted the published host identity, exposing password credentials or data sent to the rogue endpoint. Default all-in-one and non-authenticated standalone paths did not load the key. This issue is fixed in version 4.41.

• CWE-321

• https://github.com/seaweedfs/seaweedfs/commit/742bd9f3aa9d9b83c9ad71389f66566f930acaa9Patch
• https://github.com/seaweedfs/seaweedfs/pull/10390Issue Tracking, Patch
• https://github.com/seaweedfs/seaweedfs/releases/tag/4.41Release Notes
• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-hqp5-j79g-vr89Vendor Advisory, Mitigation, Exploit
• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-hqp5-j79g-vr89Vendor Advisory, Mitigation, Exploit

Published

Oct 14, 2026

Last Modified

Oct 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100404Zulip is an open-source team collaboration tool. In Zulip Se…6.5
• CVE-2026-100406dbt enables data analysts and engineers to transform their d…8.2
• CVE-2026-100407Git for Windows is the Windows port of Git. From 2.44.0.wind…4.4
• CVE-2026-100408Git for Windows is the Windows port of Git. From 2.43.0.wind…4.4
• CVE-2026-100409OpenNext Cloudflare is an open Next.js adapter for Cloudflar…7.5
• CVE-2026-10041The WCFM – Frontend Manager for WooCommerce plugin for WordP…4.3
• CVE-2026-100417RustDesk before 1.5.0 on Windows fails to enforce the one-wa…3.1
• CVE-2026-100418Flame through 2.4.0 contains an information exposure vulnera…5.3
• CVE-2026-100419gitoxide gix-fs before 0.23.0 contains a path validation byp…7
• CVE-2026-10042manga-image-translator contains a remote code execution vuln…9.8
• CVE-2026-100420A sensitive information disclosure vulnerability in the clou…6.8
• CVE-2026-10043MosaicML Composer Deserialization of Untrusted Data Remote C…7.8