Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

rustfs

12 known vulnerabilities (2 critical, 4 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
1.0.1 (Oct 3, 2026): no advisory affects it
Newest unaffected release
1.0.1 (Oct 3, 2026), the latest release
Advisories
12 · 2 critical, 4 high, 5 medium, 1 low
Weekly downloads
44
Dependents
0
Releases
4 since 0.0.1 (Jul 2, 2025)
Registry
crates.io
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 12

  • RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks

    Affected: through 0.0.2.

    Fixed in 1.0.0 (released Sep 17, 2026, 148 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.0.1, is not affected.

    9.8% of rustfs downloads in the last 90 days were affected versions (70).

  • CVE-2026-39360Medium 5.3

    RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration

    Affected: through 0.0.2.

    Fixed in 1.0.0 (released Sep 17, 2026, 163 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.0.1, is not affected.

    9.8% of rustfs downloads in the last 90 days were affected versions (70).

  • CVE-2026-27822Critical 9.1

    Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

    Affected: fixed in 1.0.0-alpha.83.

    Fixed in 1.0.0 (released Sep 17, 2026, 204 days after disclosure, the advisory names 1.0.0-alpha.83, which was never published).

    The latest release, 1.0.1, is not affected.

    9.8% of rustfs downloads in the last 90 days were affected versions (70).

  • RustFS's Missing Post Policy Validation leads to Arbitrary Object Write

    Affected: from 1.0.0-alpha.56, fixed in 1.0.0-alpha.83.

    Fixed in 1.0.0 (released Sep 17, 2026, 204 days after disclosure, the advisory names 1.0.0-alpha.83, which was never published).

    The latest release, 1.0.1, is not affected.

    0% of rustfs downloads in the last 90 days were affected versions (0).

  • CVE-2026-24762Medium 6.9

    RustFS Logs Sensitive Credentials in Plaintext

    Affected: from 1.0.0-alpha.13, fixed in 1.0.0-alpha.82.

    Fixed in 1.0.0 (released Sep 17, 2026, 226 days after disclosure, the advisory names 1.0.0-alpha.82, which was never published).

    The latest release, 1.0.1, is not affected.

    0% of rustfs downloads in the last 90 days were affected versions (0).

  • RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

    Affected: fixed in 1.0.0-alpha.78.

    Fixed in 1.0.0 (released Sep 17, 2026, 226 days after disclosure, the advisory names 1.0.0-alpha.78, which was never published).

    The latest release, 1.0.1, is not affected.

    9.8% of rustfs downloads in the last 90 days were affected versions (70).

  • RustFS RPC signature verification logs shared secret

    Affected: from 1.0.0-alpha.1, fixed in 1.0.0-alpha.80.

    Fixed in 1.0.0 (released Sep 17, 2026, 244 days after disclosure, the advisory names 1.0.0-alpha.80, which was never published).

    The latest release, 1.0.1, is not affected.

    0% of rustfs downloads in the last 90 days were affected versions (0).

  • CVE-2026-22043Medium 5.7

    RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

    Affected: from 1.0.0-alpha.13, fixed in 1.0.0-alpha.79.

    Fixed in 1.0.0 (released Sep 17, 2026, 252 days after disclosure, the advisory names 1.0.0-alpha.79, which was never published).

    The latest release, 1.0.1, is not affected.

    0% of rustfs downloads in the last 90 days were affected versions (0).

  • CVE-2026-22042Medium 5.7

    RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

    Affected: fixed in 1.0.0-alpha.79.

    Fixed in 1.0.0 (released Sep 17, 2026, 252 days after disclosure, the advisory names 1.0.0-alpha.79, which was never published).

    The latest release, 1.0.1, is not affected.

    9.8% of rustfs downloads in the last 90 days were affected versions (70).

  • CVE-2025-69255Medium 5.5

    RustFS gRPC GetMetrics deserialization panic enables remote DoS

    Affected: from 1.0.0-alpha.13, fixed in 1.0.0-alpha.78.

    Fixed in 1.0.0 (released Sep 17, 2026, 253 days after disclosure, the advisory names 1.0.0-alpha.78, which was never published).

    The latest release, 1.0.1, is not affected.

    0% of rustfs downloads in the last 90 days were affected versions (0).

  • RustFS Path Traversal Vulnerability

    Affected: from 1.0.0-alpha.13, fixed in 1.0.0-alpha.79.

    Fixed in 1.0.0 (released Sep 17, 2026, 253 days after disclosure, the advisory names 1.0.0-alpha.79, which was never published).

    The latest release, 1.0.1, is not affected.

    0% of rustfs downloads in the last 90 days were affected versions (0).

  • CVE-2025-68926Critical 9.8

    RustFS has a gRPC Hardcoded Token Authentication Bypass

    Affected: from 1.0.0-alpha.13, fixed in 1.0.0-alpha.78.

    Fixed in 1.0.0 (released Sep 17, 2026, 261 days after disclosure, the advisory names 1.0.0-alpha.78, which was never published).

    The latest release, 1.0.1, is not affected.

    0% of rustfs downloads in the last 90 days were affected versions (0).