Technical impact
SeaweedFS distributed storage systems exposed a weakness in the S3Tables/Iceberg REST management API that allowed requests signed with Sig service to be routed to an internal API without proper credential checks. The weakness is an instance of CWE‑863 (Improper Authorization). The authorization logic collapsed identities into a shared administrator account and failed open, meaning any S3 user with basic credentials could enumerate the names and AR resource information that could aid further attacks.
Affected Systems
SeaweedFS version 4.08 through 4.33. The fix was delivered in release 4.34; systems running any later version have this issue corrected.
Risk and Exploitability
The CVSS score of 4.3 indicates moderate severity, and the EPSS score of <1% reflects a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated low‑privileged S3 user who can sign SigV4 requests for the s3tables service; this path requires only legitimate access credentials and does not lead to code execution or availability compromise, but it does reveal internal identifiers.
Github GHSA