{"id":"CVE-2026-22042","aliases":["EUVD-2026-1472","GHSA-vcwh-pff9-64cc"],"status":"published","title":"RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation","description":"RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAction` instead of `ImportIAMAction`, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation. Version 1.0.0-alpha.79 fixes the issue.","severity":{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00435,"percentile":0.38177,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285","CWE-863"],"published":"2026-01-08T14:58:10Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"crates.io","package":"rustfs","fixed_in":["1.0.0-alpha.79"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"rustfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-alpha.79"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rustfs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0-alpha.79"}]}]}],"products":[{"vendor":"rustfs","product":"rustfs"}],"references":[{"url":"https://github.com/rustfs/rustfs/security/advisories/GHSA-vcwh-pff9-64cc","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22042","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vcwh-pff9-64cc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22042.json","tags":["advisory"]},{"url":"https://github.com/rustfs/rustfs","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-22042","title":"RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation","description":"RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAction` instead of `ImportIAMAction`, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation. Version 1.0.0-alpha.79 fixes the issue.","status":"published","published":"2026-01-08T14:58:10.785Z","modified":"2026-01-08T15:54:51.896Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T13:39:05.585774Z"}],"euvd":[{"id":"EUVD-2026-1472","description":"RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAction` instead of `ImportIAMAction`, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation. Version 1.0.0-alpha.79 fixes the issue.","status":"published","published":"2026-01-08T14:58:10Z","modified":"2026-01-08T15:54:51Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:48:54.487856Z"}],"ghsa":[{"id":"GHSA-vcwh-pff9-64cc","title":"RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation","description":"### Summary\n\nThe `ImportIam` admin API validates permissions using **`ExportIAMAction`** instead of **`ImportIAMAction`**, allowing a principal with *export-only* IAM permissions to perform *import* operations. Since importing IAM data performs privileged **write** actions (creating/updating users, groups, policies, and service accounts), this can lead to **unauthorized IAM modification and privilege escalation**.\n\n---\n\n### Details\n\nIn `ImportIam`, the authorization check is implemented as follows:\n\n```rust\nvalidate_admin_request(\n    \u0026req.headers,\n    \u0026cred,\n    owner,\n    false,\n    vec![Action::AdminAction(AdminAction::ExportIAMAction)],\n).await?;\n```\n\nHowever, this code resides in the **Import IAM** operation (`struct ImportIam {}`), which performs **state-changing IAM writes**.\n\nThe expected behavior is to validate against **`AdminAction::ImportIAMAction`** (or an equivalent import-specific admin action), not `ExportIAMAction`.\n\n---\n\n### PoC\n\n**Prerequisites**\n\n1. A RustFS deployment with IAM enabled.\n2. An IAM user or role that has **Export IAM** permission but **does not** have Import IAM or full admin permissions.\n3. Access credentials for that user.\n\n**Steps**\n\n1. Create or obtain an IAM principal with permission equivalent to:\n\n   ```\n   AdminAction::ExportIAMAction\n   ```\n\n   and without Import IAM privileges.\n\n2. Prepare a valid IAM import ZIP archive containing, for example:\n\n   * A new policy granting administrative permissions\n   * A user or service account bound to that policy\n\n3. Send a request to the Import IAM endpoint (the same endpoint handled by `ImportIam::call`), authenticating with the export-only credentials.\n\n4. Observe that:\n\n   * The request passes authorization.\n   * IAM entities from the archive are created or modified successfully.\n\n**Expected Result**\n\n* The request should be rejected with an authorization error (e.g., AccessDenied).\n\n**Actual Result**\n\n* The request succeeds, and IAM state is modified.","status":"published","published":"2026-01-08T20:36:17Z","modified":"2026-01-08T20:36:18Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:39:16.156387Z"}],"nvd":[{"id":"CVE-2026-22042","description":"RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAction` instead of `ImportIAMAction`, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation. Version 1.0.0-alpha.79 fixes the issue.","status":"published","published":"2026-01-08T15:15:45.443Z","modified":"2026-06-17T10:19:24.797Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T14:12:03.683495Z"}],"osv":[{"id":"CVE-2026-22042","title":"RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation","description":"RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAction` instead of `ImportIAMAction`, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation. Version 1.0.0-alpha.79 fixes the issue.","status":"published","published":"2026-01-08T14:58:10.785Z","modified":"2026-10-28T02:31:05.908319045Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"GHSA-vcwh-pff9-64cc","title":"RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation","description":"### Summary\n\nThe `ImportIam` admin API validates permissions using **`ExportIAMAction`** instead of **`ImportIAMAction`**, allowing a principal with *export-only* IAM permissions to perform *import* operations. Since importing IAM data performs privileged **write** actions (creating/updating users, groups, policies, and service accounts), this can lead to **unauthorized IAM modification and privilege escalation**.\n\n---\n\n### Details\n\nIn `ImportIam`, the authorization check is implemented as follows:\n\n```rust\nvalidate_admin_request(\n    \u0026req.headers,\n    \u0026cred,\n    owner,\n    false,\n    vec![Action::AdminAction(AdminAction::ExportIAMAction)],\n).await?;\n```\n\nHowever, this code resides in the **Import IAM** operation (`struct ImportIam {}`), which performs **state-changing IAM writes**.\n\nThe expected behavior is to validate against **`AdminAction::ImportIAMAction`** (or an equivalent import-specific admin action), not `ExportIAMAction`.\n\n---\n\n### PoC\n\n**Prerequisites**\n\n1. A RustFS deployment with IAM enabled.\n2. An IAM user or role that has **Export IAM** permission but **does not** have Import IAM or full admin permissions.\n3. Access credentials for that user.\n\n**Steps**\n\n1. Create or obtain an IAM principal with permission equivalent to:\n\n   ```\n   AdminAction::ExportIAMAction\n   ```\n\n   and without Import IAM privileges.\n\n2. Prepare a valid IAM import ZIP archive containing, for example:\n\n   * A new policy granting administrative permissions\n   * A user or service account bound to that policy\n\n3. Send a request to the Import IAM endpoint (the same endpoint handled by `ImportIam::call`), authenticating with the export-only credentials.\n\n4. Observe that:\n\n   * The request passes authorization.\n   * IAM entities from the archive are created or modified successfully.\n\n**Expected Result**\n\n* The request should be rejected with an authorization error (e.g., AccessDenied).\n\n**Actual Result**\n\n* The request succeeds, and IAM state is modified.","status":"published","published":"2026-01-08T20:36:17Z","modified":"2026-02-03T03:16:06.066149Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:56.981655Z"}]}}