SeaweedFS fixed an unauthenticated server-side request forgery (SSRF) flaw, CVE-2026-73080, in VolumeServer.FetchAndWriteNeedle with version 0.0.0-20260512171120-69da20bdaec9. The bug affects older releases and lets a remote attacker make the server fetch from arbitrary hosts and read the reply.
The problem is that VolumeServer does not validate where it is being told to connect, so the service can be used as a relay into places the network would normally hide. In cloud setups, that includes internal services and metadata endpoints that can hand back IAM credentials, so the issue is about trusted access paths, not just outbound requests.
For Internet-facing SeaweedFS deployments, the exposure sits wherever VolumeServer can reach private endpoints on the operator’s behalf. If that node can talk to cloud metadata or internal-only services, an attacker may be able to use the app as a bridge into those locations even when they are not directly exposed.