SeaweedFS is a distributed storage system that, in versions 4.0.388 through 4.41, bundled an unencrypted Ed25519 private host key within its SFTP Helm chart. This hard‑coded key can be presented to clients when the chart is deployed with sftp.enabled and sftp.enableAuth set to true, no external configuration secret is supplied, and the legacy key path remains selected. An attacker who can redirect or intercept client traffic can pose as the legitimate SFTP endpoint, potentially capturing user credentials or other sensitive data transmitted by clients that trust the published host identity.

The vulnerability affects SeaweedFS deployments using the Helm chart shipped with the 4.0.388 to 4.41 release series. All‑one, non‑authenticated standalone paths do not load the key, but any configuration that enables the SFTP service under those parameters is vulnerable. The problematic key resides in k8s/charts/seaweedfs/templates/sftp/sftp‑secret.yaml. Versions prior to 4.41 are at risk until the patch is applied.

The CVSS score of 7 indicates a high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of widespread exploitation is uncertain. Nevertheless, the attack path requires the attacker to intercept or redirect SFTP traffic and the deployment to satisfy several configuration conditions, implying moderate complexity. The presence of a hard‑coded host key grants an attacker the ability to impersonate the server and harvest credentials or data, making this a significant threat to confidentiality.