CVE-2026-77611Proof of concept (PoC) published · CISA
SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename
CVSS score
7.1
EPSS probability
%0.4
Risk score
0.0
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
7.0
CVE-2026-100413
SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments
S
Patch status unknown
10.0
CVE-2026-54917
Path traversal in Seaweedfs
S
Patch verified Public Exploits:2EPSS %2
9.8
CVE-2026-72920
SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control
S
Patch verifiedEPSS %1
8.1
CVE-2026-58372
SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys
S
Patch verifiedEPSS %1
9.3
CVE-2026-73080
SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle
S
Patch verifiedEPSS %1
8.7
CVE-2026-77298
SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy
S
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-77611"