MEDIUM 4.3 GitHub
CVE-2026-55873
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
### Summary
SeaweedFS routes requests signed with SigV4 service `s3tables` to the S3Tables
management API. Authorization on that path collapsed account-less S3 identities
into the shared `admin` account and failed open, so a user holding only ordinary
S3 `Read` credentials — and no S3Tables-specific permission — could invoke
S3Tables management operations such as `GET /buckets` and enumerate
administrator-owned table bucket inventory (names and ARNs). The same handler
backs the Iceberg REST cata
Affected Products
- go/github.com/seaweedfs/seaweedfs >= 0.0.0-20260128085517-09bb90e8dc16, < 0.0.0-20260614205536-b13463880c1f
References
- https://github.com/advisories/GHSA-hgpf-8634-g44c
- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-hgpf-8634-g44c
- https://nvd.nist.gov/vuln/detail/CVE-2026-55873
- https://github.com/seaweedfs/seaweedfs/pull/9961
This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-08-28 via GitHub. Affected: go/github.com/seaweedfs/seaweedfs >= 0.0.0-20260128085517-09bb90e8dc16, < 0.0.0-20260614205536-b13463880c1f.
vulnfeed aggregates 11507 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.