A critical authentication bypass in seaweedfs allows unauthenticated attackers to gain administrative control over the storage system and mint arbitrary credentials.

This is a missing authentication vulnerability (CWE-306) in the SeaweedIdentityAccessManagement gRPC service. When the jwt.filer_signing.key is not configured, the service fails to require authentication, permitting any network-adjacent attacker to perform administrative actions such as creating users and policies.

The CVSS score of 9.8 reflects the high risk of this vulnerability. Successful exploitation allows an attacker to gain full S3 administrative control over the storage system, which can result in data exfiltration, deletion, or the modification of sensitive storage policies.

Immediate Action: Update SeaweedFS to version 4.24 or later, which mandates authentication for the affected gRPC service.

Proactive Monitoring: Audit gRPC service access logs for unauthorized connections or unexpected calls to IAM-related RPC functions.

Compensating Controls: Restrict network access to the SeaweedFS gRPC port using firewall rules to ensure that only authorized internal services can interact with the management interface.

Public Exploit Available: Unknown

Immediate remediation is required for all exposed SeaweedFS instances. Administrators should prioritize upgrading to version 4.24 and verifying that the JWT signing key is correctly configured to prevent unauthorized access. Access to the gRPC port should be strictly limited to trusted networks to provide defense-in-depth.