—
GO-2026-6219
SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle in github.com/seaweedfs/seaweedfs
Quick fix
GO-2026-6219 — github.com/seaweedfs/seaweedfs: upgrade to the fixed version with the command below.
go get github.com/seaweedfs/seaweedfs@v0.0.0-20260512171120-69da20bdaec9Details
SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle in github.com/seaweedfs/seaweedfs
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/seaweedfs/seaweedfs
Introduced in:
0 Fixed in: 0.0.0-20260512171120-69da20bdaec9 Fix
go get github.com/seaweedfs/seaweedfs@v0.0.0-20260512171120-69da20bdaec9 References
- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-87fv-vqqr-m4jr [ADVISORY]
- https://github.com/seaweedfs/seaweedfs/commit/69da20bdaec923e5a43d8aa71bf3c0a2051fc019 [FIX]
- https://github.com/seaweedfs/seaweedfs/pull/9441 [FIX]
- https://github.com/seaweedfs/seaweedfs/releases/tag/4.24 [WEB]