THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-gv5w-hfx8-8cwq (high) — SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

[GHSA] GHSA-gv5w-hfx8-8cwq (high) — SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

medgithub_advisoriesPublished 2026-09-02

GHSA-gv5w-hfx8-8cwq Severity: high CVE: CVE-2026-72921

SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

### Impact When a filer JWT restricts a token to a set of path prefixes via `allowed_prefixes`, the authorization check used a literal byte-prefix match (`strings.HasPrefix`). A token scoped to `/tenant1` therefore also authorized requests

Indicators of compromise

Original source: https://github.com/advisories/GHSA-gv5w-hfx8-8cwq