Rustfs vulnerabilities

Products

• Rustfs 32

Newest

• rustfs RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback CVE-2026-73290 5.3 MediumAugust 12, 2026
• rustfs RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions CVE-2026-73289 8.1 HighAugust 12, 2026
• rustfs RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted CVE-2026-73288 6.1 MediumAugust 12, 2026
• rustfs RustFS: FTPS MKD bypasses IAM CreateBucket authorization CVE-2026-73287 5.4 MediumAugust 12, 2026
• rustfs RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions CVE-2026-73286 8.1 HighAugust 12, 2026
• rustfs RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged CVE-2026-73285 7.5 HighAugust 12, 2026
• rustfs RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts CVE-2026-73284 8.8 HighAugust 12, 2026
• rustfs RustFS: Version-specific object reads authorize the non-version action CVE-2026-73265 6.5 MediumAugust 12, 2026
• iidk-the-actual console RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover CVE-2026-62378 9.0 CriticalJuly 15, 2026
• rustfs RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials CVE-2026-55188 8.2 HighJune 26, 2026
• rustfs RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection CVE-2026-49991 8.6 HighJune 26, 2026
• rustfs RustFS: FTP frontend skips IAM authorization on object reads CVE-2026-55189 7.7 HighJune 26, 2026
• rustfs RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics CVE-2026-55838 4.3 MediumJune 26, 2026
• rustfs RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root CVE-2026-45043 9.3 CriticalMay 29, 2026
• rustfs RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console CVE-2026-46685 6.0 MediumMay 28, 2026
• rustfs RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation CVE-2026-45039 9.8 CriticalMay 28, 2026
• rustfs RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode] CVE-2026-45040 5.3 MediumMay 28, 2026
• rustfs RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery CVE-2026-45041 8.7 HighMay 28, 2026
• rustfs RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source CVE-2026-45042 7.1 HighMay 28, 2026
• rustfs RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers CVE-2026-45044 8.8 HighMay 28, 2026
• rustfs RustFS: Unauthenticated RustFS console license endpoint exposes license metadata CVE-2026-47136 6.9 MediumMay 28, 2026
• rustfs RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks CVE-2026-40937 8.3 HighApril 22, 2026
• rustfs RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration CVE-2026-39360 5.3 MediumApril 7, 2026
• rustfs Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover CVE-2026-27822 Fix available 9.1 CriticalFebruary 25, 2026
• rustfs RustFS's Missing Post Policy Validation leads to Arbitrary Object Write CVE-2026-27607 Public exploitFix available 8.1 HighFebruary 25, 2026
• rustfs RustFS Logs Sensitive Credentials in Plaintext CVE-2026-24762 Fix available 6.9 MediumFebruary 3, 2026
• rustfs RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers CVE-2026-21862 Fix available 7.7 HighFebruary 3, 2026
• rustfs RustFS RPC signature verification logs shared secret CVE-2026-22782 Fix available 2.9 LowJanuary 16, 2026
• rustfs RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting CVE-2026-22043 Fix available 5.7 MediumJanuary 8, 2026
• rustfs RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation CVE-2026-22042 Fix available 5.7 MediumJanuary 8, 2026
• rustfs RustFS gRPC GetMetrics deserialization panic enables remote DoS CVE-2025-69255 Fix available 5.5 MediumJanuary 7, 2026
• rustfs RustFS Path Traversal Vulnerability CVE-2025-68705 Public exploitFix available 8.8 HighJanuary 7, 2026
• rustfs RustFS has a gRPC Hardcoded Token Authentication Bypass CVE-2025-68926 Public exploitFix available EPSS 31.9% 9.8 CriticalDecember 30, 2025