GO-2026-6219 SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle in github.com/seaweedfs/seaweedfs

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle in github.com/seaweedfs/seaweedfs...

UnAuthenticated Server-Side Request Forgery (SSRF)

SeaweedFS is vulnerable to an unauthenticated Server-Side Request Forgery SSRF. The vulnerability is due to the VolumeServer.FetchAndWriteNeedle RPC accepting a caller-supplied remote endpoint without authentication or target validation, which allows an attacker to send requests to arbitrary...

EUVD-2026-56242

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volumegrpcremote.go fetches a caller-supplied remote endpoint through weed/remotestorage/s3/s3storageclient.go and writes the response into a needle. The RPC performs no authentication and no...