# cve.now: Rustfs

The newest entries naming Rustfs as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-73290](https://cve.now/CVE-2026-73290.md): RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback (CVSS 5.3)
- [CVE-2026-73289](https://cve.now/CVE-2026-73289.md): RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions (CVSS 8.1)
- [CVE-2026-73288](https://cve.now/CVE-2026-73288.md): RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted (CVSS 6.1)
- [CVE-2026-73287](https://cve.now/CVE-2026-73287.md): RustFS: FTPS MKD bypasses IAM CreateBucket authorization (CVSS 5.4)
- [CVE-2026-73286](https://cve.now/CVE-2026-73286.md): RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions (CVSS 8.1)
- [CVE-2026-73285](https://cve.now/CVE-2026-73285.md): RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged (CVSS 7.5)
- [CVE-2026-73284](https://cve.now/CVE-2026-73284.md): RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts (CVSS 8.8)
- [CVE-2026-73265](https://cve.now/CVE-2026-73265.md): RustFS: Version-specific object reads authorize the non-version action (CVSS 6.5)
- [CVE-2026-62378](https://cve.now/CVE-2026-62378.md): RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover (CVSS 9.0)
- [CVE-2026-55188](https://cve.now/CVE-2026-55188.md): RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials (CVSS 8.2)
- [CVE-2026-49991](https://cve.now/CVE-2026-49991.md): RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection (CVSS 8.6)
- [CVE-2026-55189](https://cve.now/CVE-2026-55189.md): RustFS: FTP frontend skips IAM authorization on object reads (CVSS 7.7)
- [CVE-2026-55838](https://cve.now/CVE-2026-55838.md): RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics (CVSS 4.3)
- [CVE-2026-45043](https://cve.now/CVE-2026-45043.md): RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root (CVSS 9.3)
- [CVE-2026-46685](https://cve.now/CVE-2026-46685.md): RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console (CVSS 6.0)
- [CVE-2026-45039](https://cve.now/CVE-2026-45039.md): RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation (CVSS 9.8)
- [CVE-2026-45040](https://cve.now/CVE-2026-45040.md): RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs \[Debug Mode\] (CVSS 5.3)
- [CVE-2026-45041](https://cve.now/CVE-2026-45041.md): RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery (CVSS 8.7)
- [CVE-2026-45042](https://cve.now/CVE-2026-45042.md): RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source (CVSS 7.1)
- [CVE-2026-45044](https://cve.now/CVE-2026-45044.md): RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers (CVSS 8.8)
- [CVE-2026-47136](https://cve.now/CVE-2026-47136.md): RustFS: Unauthenticated RustFS console license endpoint exposes license metadata (CVSS 6.9)
- [CVE-2026-40937](https://cve.now/CVE-2026-40937.md): RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks (CVSS 8.3)
- [CVE-2026-39360](https://cve.now/CVE-2026-39360.md): RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration (CVSS 5.3)
- [CVE-2026-27822](https://cve.now/CVE-2026-27822.md): Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover (CVSS 9.1)
- [CVE-2026-27607](https://cve.now/CVE-2026-27607.md): RustFS's Missing Post Policy Validation leads to Arbitrary Object Write (CVSS 8.1)
- [CVE-2026-24762](https://cve.now/CVE-2026-24762.md): RustFS Logs Sensitive Credentials in Plaintext (CVSS 6.9)
- [CVE-2026-21862](https://cve.now/CVE-2026-21862.md): RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers (CVSS 7.7)
- [CVE-2026-22782](https://cve.now/CVE-2026-22782.md): RustFS RPC signature verification logs shared secret (CVSS 2.9)
- [CVE-2026-22043](https://cve.now/CVE-2026-22043.md): RustFS has IAM deny\_only Short-Circuit that Allows Privilege Escalation via Service Account Minting (CVSS 5.7)
- [CVE-2026-22042](https://cve.now/CVE-2026-22042.md): RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation (CVSS 5.7)
- [CVE-2025-69255](https://cve.now/CVE-2025-69255.md): RustFS gRPC GetMetrics deserialization panic enables remote DoS (CVSS 5.5)
- [CVE-2025-68705](https://cve.now/CVE-2025-68705.md): RustFS Path Traversal Vulnerability (CVSS 8.8)
- [CVE-2025-68926](https://cve.now/CVE-2025-68926.md): RustFS has a gRPC Hardcoded Token Authentication Bypass (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/rustfs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.