Summary
SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
Affected component
weed/server/filer_server_handlers.go(JWTallowed_prefixesauthorization check)
Workarounds
Where feasible, choose prefix names that are not string-prefixes of one another (e.g. keep a trailing separator convention). Upgrade to 4.24.
References
- Reported by Kadir Arslan (https://github.com/KadirArslan)
Impact
When a filer JWT restricts a token to a set of path prefixes via allowed_prefixes, the authorization check used a literal byte-prefix match (strings.HasPrefix). A token scoped to /tenant1 therefore also authorized requests to sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup.
In a multi-tenant deployment this lets the holder of one tenant's token access another tenant's data. Because allowed_prefixes gates both read and write tokens, the impact covers cross-tenant reads and writes. A valid scoped token is required, so this is an authorization bypass rather than a fully unauthenticated flaw.
The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions. Typical impact: unauthorized data access or execution of privileged operations.
CVE-2026-72921 has a CVSS score of 8.1 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.0.0-20260512171048-05ed5c9ae8a2); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Fixed in 4.24. The check now matches on /-separated path components after path.Clean normalisation, so /tenant1 authorizes only /tenant1 and its descendants, not /tenant1234 or other sibling paths.
Frequently Asked Questions
- What is CVE-2026-72921? CVE-2026-72921 is a high-severity incorrect authorization vulnerability in github.com/seaweedfs/seaweedfs (go), affecting versions < 0.0.0-20260512171048-05ed5c9ae8a2. It is fixed in 0.0.0-20260512171048-05ed5c9ae8a2. The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions.
- How severe is CVE-2026-72921? CVE-2026-72921 has a CVSS score of 8.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/seaweedfs/seaweedfs are affected by CVE-2026-72921? github.com/seaweedfs/seaweedfs (go) versions < 0.0.0-20260512171048-05ed5c9ae8a2 is affected.
- Is there a fix for CVE-2026-72921? Yes. CVE-2026-72921 is fixed in 0.0.0-20260512171048-05ed5c9ae8a2. Upgrade to this version or later.
- Is CVE-2026-72921 exploitable, and should I be worried? Whether CVE-2026-72921 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-72921 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-72921? Upgrade
github.com/seaweedfs/seaweedfsto 0.0.0-20260512171048-05ed5c9ae8a2 or later.