CVE-2026-100413
HIGH 7SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfs_sftp_ssh_private_key. A standalone deployment presented that public key when sftp.enabled and sftp.enableAuth were true, sftp.existingConfigSecret was not supplied, the legacy sftp.sshPrivateKey path remained selected, a valid config-ssh Secret allowed startup, and hostKeysFolder did not provide a later Ed25519 signer. An attacker able to redirect or intercept client traffic could impersonate that SFTP endpoint to clients that trusted the published host identity, exposing password credentials or data sent to the rogue endpoint. Default all-in-one and non-authenticated standalone paths did not load the key. This issue is fixed in version 4.41.
Severe if exploited (CVSS 7), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 36th percentile
Impact if exploited
7CVSS 4.0 · HIGH
- ConfidentialityHigh
- IntegrityLow
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ⚠User interaction: Requires active user interaction
- ⚠Complexity: Needs a race window or specific setup
- ⚠Requirements: Specific conditions must be present
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-321: : Use of Hard-coded Cryptographic Key
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
References and research data (JSON)
All CVSS metrics
- HIGH 7 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N - HIGH 7 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101519 EUVD · EUVD-2026-101519
Technical & other
- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-hqp5-j79g-vr89 CVE record · GitHub_M · Updated 2026-10-14T18:03:12.709Z
NVD · CVE-2026-100413 · Updated 2026-10-16T16:00:33.533 - https://github.com/seaweedfs/seaweedfs/pull/10390 CVE record · GitHub_M · Updated 2026-10-14T18:03:12.709Z
NVD · CVE-2026-100413 · Updated 2026-10-16T16:00:33.533 - https://github.com/seaweedfs/seaweedfs/commit/742bd9f3aa9d9b83c9ad71389f66566f930acaa9 CVE record · GitHub_M · Updated 2026-10-14T18:03:12.709Z
NVD · CVE-2026-100413 · Updated 2026-10-16T16:00:33.533 - https://github.com/seaweedfs/seaweedfs/releases/tag/4.41 CVE record · GitHub_M · Updated 2026-10-14T18:03:12.709Z
NVD · CVE-2026-100413 · Updated 2026-10-16T16:00:33.533