Rustfs vulnerabilities
33 CVEs and advisories name Rustfs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-73290RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback
- CVE-2026-73289RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions
- CVE-2026-73288RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted
- CVE-2026-73287RustFS: FTPS MKD bypasses IAM CreateBucket authorization
- CVE-2026-73286RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions
- CVE-2026-73285RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged
- CVE-2026-73284RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts
- CVE-2026-73265RustFS: Version-specific object reads authorize the non-version action
- CVE-2026-62378RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover
- CVE-2026-55188RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials
- CVE-2026-49991RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection
- CVE-2026-55189RustFS: FTP frontend skips IAM authorization on object reads
- CVE-2026-55838RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics
- CVE-2026-45043RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root
- CVE-2026-46685RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console
- CVE-2026-45039RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation
- CVE-2026-45040RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]
- CVE-2026-45041RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery
- CVE-2026-45042RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source
- CVE-2026-45044RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers
- CVE-2026-47136RustFS: Unauthenticated RustFS console license endpoint exposes license metadata
- CVE-2026-40937RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks
- CVE-2026-39360RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration
- CVE-2026-27822Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover
- CVE-2026-27607RustFS's Missing Post Policy Validation leads to Arbitrary Object Write
- CVE-2026-24762RustFS Logs Sensitive Credentials in Plaintext
- CVE-2026-21862RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers
- CVE-2026-22782RustFS RPC signature verification logs shared secret
- CVE-2026-22043RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
- CVE-2026-22042RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation