SeaweedFS, a distributed storage system, allowed unauthenticated access to the SeaweedIdentityAccessManagement gRPC service before version 4.24. When the jwt.filer_signing.key setting was not defined, any client that could reach the filer’s gRPC port could invoke IAM RPCs such as CreateUser, CreateAccessKey, and PutPolicy, enabling the creation and management of IAM credentials and policies. This effectively grants an attacker full S3 administrative control over the system, allowing them to read, write, delete, and configure data and policies, thereby compromising confidentiality, integrity, and availability of all stored objects.

The vulnerability affects SeaweedFS’s filer component in all releases before 4.24. Users deploying SeaweedFS versions 4.23 and earlier with the default configuration—where jwt.filer_signing.key is unset—are susceptible. The issue is resolved in the 4.24 release series and later.

The flaw carries a high CVSS score of 9.8 and is not currently listed in CISA’s KEV catalog. Because the gRPC port is typically exposed to the network or internal cluster, an attacker who can reach it can call the IAM RPCs directly, leading to administrative privileges without authentication. The EPSS score is not available, but the severity and the ability to perform privileged operations suggest a high likelihood of real-world exploitation in environments where the filer is accessible.