Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-06-30T15:57:36 github.com/seaweedfs/seaweedfs: SeaweedFS: Information disclosure via unvalidated JSONP callback parameter 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CWE-79

SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper (weed/server/common.go), with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON endpoint that uses writeJson - including the unauthenticated master endpoints /dir/status, /dir/lookup and /cluster/status, the volume server /status, and the filer directory listing, all reachable in the default configuration (no -whiteList, no security.toml, bound to 0.0.0.0) - can therefore be loaded cross-origin via a script tag with a chosen callback, letting a third-party web page read cluster topology, volume server URLs and gRPC ports, file identifiers, and directory listings. Because the callback string is reflected at the start of the body and no nosniff header is sent, MIME-sniffing clients may also interpret the reflected content as HTML.

A flaw was found in SeaweedFS. This vulnerability allows a remote attacker to disclose sensitive information by exploiting an unvalidated JSONP (JavaScript Object Notation with Padding) callback parameter. The system reflects the callback parameter directly into responses without proper validation or security headers, enabling cross-origin loading of JSON endpoints. This can lead to the exposure of critical data such as cluster topology, server URLs, and directory listings to unauthorized third-party web pages.

A flaw was found in SeaweedFS before version 4.30, where the JSONP callback query parameter is reflected verbatim into responses without validation, enabling cross-origin information disclosure of cluster topology, server URLs, and directory listings. Red Hat Cryostat ships a private fork of SeaweedFS as a storage backend in the cryostat-storage container. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Cryostat 4 Fix deferred cryostat/cryostat-storage-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-58371 https://nvd.nist.gov/vuln/detail/CVE-2026-58371 https://github.com/geo-chen/oss/blob/main/seaweedfs.md https://github.com/seaweedfs/seaweedfs/commit/77dcb20a7485074d37340985d53103f94538abe6 https://github.com/seaweedfs/seaweedfs/pull/9686 https://github.com/seaweedfs/seaweedfs/releases/tag/4.30 https://www.vulncheck.com/advisories/seaweedfs-cross-origin-information-disclosure-via-unvalidated-jsonp-callback-parameter