What is the CVSS score of CVE-2026-21862?

CVE-2026-21862 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Rustfs are affected by CVE-2026-21862?

CVE-2026-21862 affects RustFS distributed object storage systems with HIGH severity (CVSS 7.5), creating potential risk to organizations relying on this technology for data storage and retrieval…. A patch is available.

How to fix or mitigate CVE-2026-21862?

Within 24 hours: Inventory all RustFS deployments and assess exposure scope; isolate affected systems from production networks where feasible. Within 7 days: Implement network segmentation to restrict RustFS access to trusted internal networks only; enable enhanced monitoring and logging on affected systems. Within 30 days: Monitor vendor security advisories for patch availability; develop and test patch deployment procedures; plan phased rollout of fixes across your environment.

Rustfs CVE-2026-21862

HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-02-03 security-advisories@github.com

GHSA-fc6g-2gcp-2qrq

Authentication Bypass Rustfs

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 03, 2026 - 16:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies. This issue has been patched in version alpha.78.

AnalysisAI

RustFS is a distributed object storage system built in Rust. [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-290 (Authentication Bypass by Spoofing). Affects Rustfs. RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies. This issue has been patched in version alpha.78.