SeaweedFS S3 API: raw OIDC JWT bypasses IAM role trust policy and grants that role's bucket access

Impact

SeaweedFS is commonly used as the object store behind dataset and checkpoint buckets on GPU fleets. Its S3 endpoint accepts an external OIDC JWT presented directly in the Authorization header and maps it to an IAM role without checking that role's trust policy, so any holder of a valid token from a federated provider can act as a role they were never permitted to assume. The STS AssumeRoleWithWebIdentity path enforces the trust policy correctly, so an operator reading only the STS configuration would believe access is constrained. The practical result is read, write and delete on whatever buckets the mapped role can touch, which on a shared cluster means one tenant's OIDC identity reaching another tenant's training data, model artifacts or checkpoints.

Who can reach it

Any user who can obtain a valid OIDC token from a provider the deployment accepts and reach the SeaweedFS S3 endpoint. Authentication is required, but only as an ordinary federated user - no possession of the target role's credentials is needed.

What to do

Upgrade SeaweedFS to 4.40, which contains the fix (commit ac524e1). This is a service upgrade and restart of the S3 gateway/filer processes rather than anything touching GPU nodes; workloads holding open S3 sessions will see them break during the restart. Until the upgrade lands, restrict which OIDC issuers the S3 endpoint accepts and review role-to-bucket mappings for any role reachable by a broader identity pool than intended.

References

Related entries

• HPE iLO3/4/5: Remote unauthenticated denial of service against the management controllerCVE-2018-7093 · HPE iLO3/4/5High
• NAKIVO Backup & Replication: Unauthenticated absolute path traversal via getImageByPathCVE-2024-48248 · NAKIVO Backup & ReplicationHigh
• Socomec DIRIS Digiware M-70 1.6.9 (Modbus TCP and Modbus RTU-over-TCP): A large cluster of unauthenticated ModbusCVE-2024-48882 · Socomec DIRIS Digiware M-70 1.6.9 (Modbus TCP and Modbus RTU-over-TCP)High
• Ivanti Endpoint Manager (EPM): Auth bypass via alternate pathCVE-2026-1603 · Ivanti Endpoint Manager (EPM)High
• Pure Storage FlashArray Purity (management interface privilege bypass): An authenticated low-privileged user reachesCVE-2026-6444 · Pure Storage FlashArray Purity (management interface privilege bypass)High
• rclone (serve restic): Path validation in serve restic is incomplete, so an authenticated caller escapes the configuredCVE-2026-71309 · rclone (serve restic)High