GO-2026-6329 SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets in github.com/seaweedfs/seaweedfs

🗓️ 02 Sep 2026 18:37:27Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Improper authorization in SeaweedFS S3Tables/Iceberg REST API lets low-priv user list admin buckets.

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2026-55873	8 Jul 202614:48	–	attackerkb
Circl	CVE-2026-55873	29 Aug 202612:32	–	circl
CVE	CVE-2026-55873	8 Jul 202614:48	–	cve
Cvelist	CVE-2026-55873 SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets	8 Jul 202614:48	–	cvelist
EUVD	EUVD-2026-42286	28 Aug 202622:16	–	euvd
Github Security Blog	SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets	28 Aug 202622:16	–	github
NVD	CVE-2026-55873	8 Jul 202615:16	–	nvd
OSV	BIT-SEAWEEDFS-2026-55873 SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets	14 Jul 202608:55	–	osv
OSV	GHSA-HGPF-8634-G44C SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets	28 Aug 202622:16	–	osv
OSV	MINI-3FC5-7G54-5FC3	30 Aug 202614:15	–	osv

Source	Link
github	www.github.com/seaweedfs/seaweedfs/security/advisories/GHSA-hgpf-8634-g44c
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-55873
github	www.github.com/seaweedfs/seaweedfs/commit/b13463880c1fa62e255c058a9228b63cc95b4b36
github	www.github.com/seaweedfs/seaweedfs/pull/9961
github	www.github.com/seaweedfs/seaweedfs/releases/tag/4.34

02 Sep 2026 19:55Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14.3

EPSS0.00342

SSVC

SeaweedFS Improper Authorization S3Tables API Iceberg REST Bucket Enumeration Low Privilege