CVE-2026-55873

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55873
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-55873.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-55873
Aliases
Downstream
MINI (2)
openSUSE (1)
SUSE (2)
Related
openSUSE (1)
SUSE (2)
Published
2026-07-08T14:48:37Z
Modified
2026-10-16T02:36:03Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
Details

SeaweedFS is a distributed storage system. In versions 4.08 through 4.33, requests signed with SigV4 service s3tables are routed to the S3Tables management API where authorization collapses account-less S3 identities into the shared admin account and fails open, allowing an authenticated low-privileged S3 user to enumerate administrator-owned table bucket names and ARNs. This issue is fixed in version 4.34.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55873.json"
}
References

Affected packages

Git / github.com/seaweedfs/seaweedfs

Affected ranges

Type
GIT
Repo
https://github.com/seaweedfs/seaweedfs
Events
Introduced
330bd92ddce763649d07e078d550cb03eda6a593
Fixed
c6cf5a5bd7c87694c8d71ab41571f1412170ab2a
Fixed
b13463880c1fa62e255c058a9228b63cc95b4b36
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "4.08"
                },
                {
                    "fixed": "4.34"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "b13463880c1fa62e255c058a9228b63cc95b4b36"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "4.34",
            "range": [
                {
                    "fixed": "c6cf5a5bd7c87694c8d71ab41571f1412170ab2a"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

4.*
4.08
4.09
4.12
4.13
4.15
4.16
4.17
4.18
4.19
4.20
4.21
4.22
4.23
4.24
4.25
4.26
4.27
4.28
4.29
4.30
4.31
4.32
4.33

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-55873.json"