# rustfs (crates.io) vulnerabilities 12 known vulnerabilities (2 critical, 4 high, 5 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.0.1 (Oct 3, 2026): no advisory affects it - Newest unaffected release: 1.0.1 (Oct 3, 2026), the latest release - Weekly downloads: 44 - Dependents: 0 - Releases: 4 since 0.0.1 (Jul 2, 2025) - Registry: https://crates.io/crates/rustfs - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-40937: 0.0.1 to 0.0.2 (1.0.0 is outside it) - CVE-2026-39360: 0.0.1 to 0.0.2 (1.0.0 is outside it) - CVE-2026-27822: 0.0.1 to 0.0.2 (1.0.0 is outside it) - CVE-2026-27607: no published release is affected - CVE-2026-24762: no published release is affected - CVE-2026-21862: 0.0.1 to 0.0.2 (1.0.0 is outside it) - CVE-2026-22782: no published release is affected - CVE-2026-22043: no published release is affected - CVE-2026-22042: 0.0.1 to 0.0.2 (1.0.0 is outside it) - CVE-2025-69255: no published release is affected - CVE-2025-68705: no published release is affected - CVE-2025-68926: no published release is affected ## Advisories (12) ### [CVE-2026-40937](https://cve.now/CVE-2026-40937): RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks - Severity: High 8.3 - Published: Apr 22, 2026 - Affected: through 0.0.2. - Fixed in 1.0.0 (released Sep 17, 2026, 148 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.0.1, is not affected. - 9.8% of rustfs downloads in the last 90 days were affected versions (70). ### [CVE-2026-39360](https://cve.now/CVE-2026-39360): RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration - Severity: Medium 5.3 - Published: Apr 7, 2026 - Affected: through 0.0.2. - Fixed in 1.0.0 (released Sep 17, 2026, 163 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.0.1, is not affected. - 9.8% of rustfs downloads in the last 90 days were affected versions (70). ### [CVE-2026-27822](https://cve.now/CVE-2026-27822): Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover - Severity: Critical 9.1 - Published: Feb 25, 2026 - Affected: fixed in 1.0.0-alpha.83. - Fixed in 1.0.0 (released Sep 17, 2026, 204 days after disclosure, the advisory names 1.0.0-alpha.83, which was never published). - The latest release, 1.0.1, is not affected. - 9.8% of rustfs downloads in the last 90 days were affected versions (70). ### [CVE-2026-27607](https://cve.now/CVE-2026-27607): RustFS's Missing Post Policy Validation leads to Arbitrary Object Write - Severity: High 8.1 - Published: Feb 25, 2026 - Affected: from 1.0.0-alpha.56, fixed in 1.0.0-alpha.83. - Fixed in 1.0.0 (released Sep 17, 2026, 204 days after disclosure, the advisory names 1.0.0-alpha.83, which was never published). - The latest release, 1.0.1, is not affected. - 0% of rustfs downloads in the last 90 days were affected versions (0). ### [CVE-2026-24762](https://cve.now/CVE-2026-24762): RustFS Logs Sensitive Credentials in Plaintext - Severity: Medium 6.9 - Published: Feb 3, 2026 - Affected: from 1.0.0-alpha.13, fixed in 1.0.0-alpha.82. - Fixed in 1.0.0 (released Sep 17, 2026, 226 days after disclosure, the advisory names 1.0.0-alpha.82, which was never published). - The latest release, 1.0.1, is not affected. - 0% of rustfs downloads in the last 90 days were affected versions (0). ### [CVE-2026-21862](https://cve.now/CVE-2026-21862): RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers - Severity: High 7.7 - Published: Feb 3, 2026 - Affected: fixed in 1.0.0-alpha.78. - Fixed in 1.0.0 (released Sep 17, 2026, 226 days after disclosure, the advisory names 1.0.0-alpha.78, which was never published). - The latest release, 1.0.1, is not affected. - 9.8% of rustfs downloads in the last 90 days were affected versions (70). ### [CVE-2026-22782](https://cve.now/CVE-2026-22782): RustFS RPC signature verification logs shared secret - Severity: Low 2.9 - Published: Jan 16, 2026 - Affected: from 1.0.0-alpha.1, fixed in 1.0.0-alpha.80. - Fixed in 1.0.0 (released Sep 17, 2026, 244 days after disclosure, the advisory names 1.0.0-alpha.80, which was never published). - The latest release, 1.0.1, is not affected. - 0% of rustfs downloads in the last 90 days were affected versions (0). ### [CVE-2026-22043](https://cve.now/CVE-2026-22043): RustFS has IAM deny\_only Short-Circuit that Allows Privilege Escalation via Service Account Minting - Severity: Medium 5.7 - Published: Jan 8, 2026 - Affected: from 1.0.0-alpha.13, fixed in 1.0.0-alpha.79. - Fixed in 1.0.0 (released Sep 17, 2026, 252 days after disclosure, the advisory names 1.0.0-alpha.79, which was never published). - The latest release, 1.0.1, is not affected. - 0% of rustfs downloads in the last 90 days were affected versions (0). ### [CVE-2026-22042](https://cve.now/CVE-2026-22042): RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation - Severity: Medium 5.7 - Published: Jan 8, 2026 - Affected: fixed in 1.0.0-alpha.79. - Fixed in 1.0.0 (released Sep 17, 2026, 252 days after disclosure, the advisory names 1.0.0-alpha.79, which was never published). - The latest release, 1.0.1, is not affected. - 9.8% of rustfs downloads in the last 90 days were affected versions (70). ### [CVE-2025-69255](https://cve.now/CVE-2025-69255): RustFS gRPC GetMetrics deserialization panic enables remote DoS - Severity: Medium 5.5 - Published: Jan 7, 2026 - Affected: from 1.0.0-alpha.13, fixed in 1.0.0-alpha.78. - Fixed in 1.0.0 (released Sep 17, 2026, 253 days after disclosure, the advisory names 1.0.0-alpha.78, which was never published). - The latest release, 1.0.1, is not affected. - 0% of rustfs downloads in the last 90 days were affected versions (0). ### [CVE-2025-68705](https://cve.now/CVE-2025-68705): RustFS Path Traversal Vulnerability - Severity: High 8.8 - Published: Jan 7, 2026 - Affected: from 1.0.0-alpha.13, fixed in 1.0.0-alpha.79. - Fixed in 1.0.0 (released Sep 17, 2026, 253 days after disclosure, the advisory names 1.0.0-alpha.79, which was never published). - The latest release, 1.0.1, is not affected. - 0% of rustfs downloads in the last 90 days were affected versions (0). ### [CVE-2025-68926](https://cve.now/CVE-2025-68926): RustFS has a gRPC Hardcoded Token Authentication Bypass - Severity: Critical 9.8 - Published: Dec 30, 2025 - Affected: from 1.0.0-alpha.13, fixed in 1.0.0-alpha.78. - Fixed in 1.0.0 (released Sep 17, 2026, 261 days after disclosure, the advisory names 1.0.0-alpha.78, which was never published). - The latest release, 1.0.1, is not affected. - 0% of rustfs downloads in the last 90 days were affected versions (0). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/crates.io/rustfs Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.