CVE-2026-55873

SeaweedFS is a distributed storage system. In versions 4.08 through 4.33, requests signed with SigV4 service s3tables are routed to the S3Tables management API where authorization collapses account-less S3 identities into the shared admin account and fails open, allowing an authenticated low-privileged S3 user to enumerate administrator-owned table bucket names and ARNs. This issue is fixed in version 4.34.

• CWE-863

• https://github.com/seaweedfs/seaweedfs/commit/b13463880c1fa62e255c058a9228b63cc95b4b36
• https://github.com/seaweedfs/seaweedfs/pull/9961
• https://github.com/seaweedfs/seaweedfs/releases/tag/4.34
• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-hgpf-8634-g44c

Published

Jul 8, 2026

Last Modified

Jul 8, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55864GeoNetwork is a catalog application to manage spatially refe…7.8
• CVE-2026-55865Python Liquid is a Python engine for the Liquid template lan…7.1
• CVE-2026-55866SpiceDB is an open source database system for creating and m…3.7
• CVE-2026-55867Graylog is a free and open log management platform. From 6.2…5.3
• CVE-2026-5587A vulnerability was identified in wbbeyourself MAC-SQL up to…6.3
• CVE-2026-55870GoCD is a continuous deliver server. Prior to 26.1.0, GoCD c…2.3
• CVE-2026-55874SeaweedFS is a distributed storage system. Prior to 4.34, th…7.7
• CVE-2026-55877Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.…6.1
• CVE-2026-55878Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.…7.8
• CVE-2026-55879OpenReplay is a self-hosted session replay suite. From 1.24.…9.3
• CVE-2026-5588Use of a Broken or Risky Cryptographic Algorithm vulnerabili…7.5
• CVE-2026-55880OpenReplay is a self-hosted session replay suite. In 1.27.0 …7.1