{"vulnerability": "cve-2026-5587", "sightings": [{"uuid": "68cbd222-e74b-461f-bb69-f403a048bd90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55874", "type": "seen", "source": "https://gist.github.com/alon710/f39d221628c93e95f65b186b807e9a92", "content": "# CVE-2026-55874: CVE-2026-55874: Cross-Bucket Path Traversal in SeaweedFS S3 API Gateway\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55874\n\n## Summary\nA critical path traversal vulnerability (CVE-2026-55874) in the SeaweedFS S3 API Gateway prior to version 4.34 allows authenticated remote attackers with write access to at least one bucket to bypass isolation. By supplying crafted directory traversal sequences in the X-Amz-Copy-Source header, an attacker can read objects from arbitrary buckets on the same deployment.\n\n## TL;DR\nSeaweedFS S3 API Gateway allows cross-bucket reads via path traversal in the X-Amz-Copy-Source header prior to version 4.34.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 7.7\n- **EPSS Score**: 0.00606\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SeaweedFS\n- **SeaweedFS**: < 4.34 (Fixed in: `4.34`)\n\n## Mitigation\n\n- Upgrade SeaweedFS to version 4.34 or later to address the vulnerability in the codebase.\n- Deploy Web Application Firewall (WAF) rules targeting the X-Amz-Copy-Source header to filter and block path traversal sequences.\n- Audit historic S3 access logs and reverse proxy logs for requests involving parent directory segments in copy handlers.\n\n**Remediation Steps:**\n1. Identify all deployed SeaweedFS S3 API Gateway instances.\n2. Schedule maintenance windows to deploy SeaweedFS version 4.34 or higher.\n3. If immediate upgrade is impossible, write a custom WAF signature or Nginx rule to check the X-Amz-Copy-Source header for path-traversal strings.\n4. Verify blocking efficacy with standard S3 testing utilities.\n\n## References\n\n- [SeaweedFS Fix Commit](https://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd)\n- [SeaweedFS Pull Request #9929](https://github.com/seaweedfs/seaweedfs/pull/9929)\n- [SeaweedFS Release 4.34](https://github.com/seaweedfs/seaweedfs/releases/tag/4.34)\n- [GitHub Security Advisory GHSA-56wq-x3wv-3ff4](https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4)\n- [NVD CVE-2026-55874 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-55874)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-55874)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55874) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T11:31:50.433163Z"}, {"uuid": "b3df1856-099f-41eb-b19a-c60d6a9cefe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55879", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqd5l36rvg2d", "content": "\ud83d\udd34 CVE-2026-55879 - Critical (9.3)\n\nOpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay track...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55879/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-10T22:01:31.981863Z"}, {"uuid": "37639c2f-eb16-4981-8977-22e2959bcb5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55879", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqdbxkdesk2h", "content": "CVE-2026-55879 - openreplay\nAn attacker can inject malicious scripts into OpenReplay, allowing them to access sensitive information and take over a dashboard account. This affects OpenReplay users who have not\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openreplay #CVE #infosec", "creation_timestamp": "2026-07-10T23:20:04.984087Z"}, {"uuid": "856339a6-05f6-45b3-9978-54d786031f9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55879", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdmmdchgl2x", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55879 \u0432 OpenReplay: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/F1812B66-3E47-4919-85A7-1C9739F54567", "creation_timestamp": "2026-07-11T02:30:39.633040Z"}, {"uuid": "3998fe33-6373-4f7b-925b-88dd4adfa02b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55879", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mqdvo74fnf2l", "content": "CVE-2026-55879 - Critical XSS in OpenReplay. Unauthenticated attackers can inject scripts via tracking SDK, steal session JWTs. CVSS 9.3. No patch available - disable public project keys immediately. #CVE #infosec #OpenReplay\n\nhttps://www.valtersit.com/cve/CVE-2026-55879/", "creation_timestamp": "2026-07-11T05:12:46.679065Z"}, {"uuid": "d92e077d-368a-4337-85a1-8bf4a1745415", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55879", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkugn6e2k2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55879 \u0432 OpenReplay: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/42D60D5A-5F2B-45A1-8572-59B18D03D83F", "creation_timestamp": "2026-07-13T23:39:16.858838Z"}, {"uuid": "2b115675-4754-4969-b0de-00842a88a9d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55873", "type": "seen", "source": "https://gist.github.com/alon710/6d797362e9ee007306455f608524f8a6", "content": "# CVE-2026-55873: CVE-2026-55873: Improper Authorization in SeaweedFS S3Tables and Iceberg REST Management APIs\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55873\n\n## Summary\nAn improper authorization vulnerability in SeaweedFS versions 4.08 through 4.33 allows authenticated, low-privileged users to bypass directory isolation and perform unauthorized metadata operations within S3Tables and Iceberg REST interfaces. The vulnerability arises from an automatic collapse of account-less static identities to the default administrative principal, combined with a fail-open default policy configuration and self-referential authorization parameters in the table bucket listing routines. Together, these logical flaws expose administrative configurations and namespace architectures to unprivileged actors. The issue is resolved in version 4.34 by enforcing capability-based access checks, isolating fallback modes, and performing granular access verification on target buckets.\n\n## TL;DR\nSeaweedFS S3Tables and Iceberg REST APIs incorrectly map account-less static S3 identities to the administrative role. Under default configurations, this behavior lets standard authenticated users bypass namespace isolation boundaries and access all table buckets. Upgrading to SeaweedFS version 4.34 fixes this issue.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Incorrect Authorization)\n- **Attack Vector**: Network (Remote)\n- **CVSS Score**: 4.3 (Medium)\n- **EPSS Score**: 0.00342 (26.83% percentile)\n- **Exploit Status**: None (Analytical only)\n- **KEV Status**: Not listed in CISA KEV\n\n## Affected Systems\n\n- SeaweedFS S3Tables\n- SeaweedFS Iceberg REST Catalog\n- **SeaweedFS**: >= 4.08, < 4.34 (Fixed in: `4.34`)\n\n## Mitigation\n\n- Upgrade SeaweedFS to version 4.34 or higher to enforce proper permission validation.\n- Implement network firewalls or security groups to restrict access to S3Tables and Iceberg REST endpoints.\n- Define explicit 'Deny' policies for low-privileged users to override the default-allow fallback logic.\n\n**Remediation Steps:**\n1. Audit existing SeaweedFS deployments to identify versions between 4.08 and 4.33.\n2. Download and deploy the SeaweedFS v4.34 package or container image.\n3. Restart the services and verify that S3Tables configuration settings are properly restricted.\n4. Test with a low-privileged test account to ensure table bucket listings are filtered based on actual ownership.\n\n## References\n\n- [SeaweedFS v4.34 Release Notes](https://github.com/seaweedfs/seaweedfs/releases/tag/4.34)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55873) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T12:32:24.295186Z"}]}