CVE-2026-58371
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in SeaweedFS before version 4.30 reflects the callback query parameter verbatim in JavaScript responses without validation, missing X-Content-Type-Options: nosniff header and CORS allow-list. This allows cross-origin attacks on unauthenticated endpoints.
Risk Assessment
The organization risks exposure of sensitive information including cluster topology, volume server addresses, gRPC ports, file identifiers, and directory listings, which can be read by third-party web pages.
Recommendation
Upgrade SeaweedFS to version 4.30 or later immediately. Additionally, enable CORS allow-list and X-Content-Type-Options: nosniff header in the default configuration.
Original NVD description (English source)
SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper (weed/server/common.go), with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON endpoint that uses writeJson - including the unauthenticated master endpoints /dir/status, /dir/lookup and /cluster/status, the volume server /status, and the filer directory listing, all reachable in the default configuration (no -whiteList, no security.toml, bound to 0.0.0.0) - can therefore be loaded cross-origin via a script tag with a chosen callback, letting a third-party web page read cluster topology, volume server URLs and gRPC ports, file identifiers, and directory listings. Because the callback string is reflected at the start of the body and no nosniff header is sent, MIME-sniffing clients may also interpret the reflected content as HTML.