Rustfs
CVE-2026-27607
HIGH
GHSA-w5fh-f8xh-5x3p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain presigned POST URL
-
ExploitCraft request bypassing policy constraints
-
ExecutionUpload oversized file to arbitrary key
-
ImpactExhaust storage or access unauthorized data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | RustFS versions 1.0.0-alpha.56 through 1.0.0-alpha.82 with presigned POST (PostObject) enabled. Attacker requires valid AWS credentials to generate presigned URLs; policy validation bypass allows circumventing content-length-range, starts-with, and Content-Type restrictions. |
| Impact | CVSS 8.1 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation no authentication required. |
| Exploit ScenarioDerived | An attacker without authentication could exploit this flaw, storage exhaustion, unauthorized data access, and security b. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Insufficient input validation in RustFS versions 1.0.0-alpha.56 through 1.0.0-alpha.82 allows authenticated attackers to circumvent presigned POST upload policy restrictions, bypassing content-length-range, starts-with, and Content-Type controls. An attacker can exploit this to upload oversized files, write to arbitrary object keys, and spoof file types, resulting in storage exhaustion and potential unauthorized data access.
Earlier versions of this analysis (1)
RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. [CVSS 8.1 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Validate file types by content. Store uploads outside web root. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in cargo
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-20 (Improper Input Validation). Affects Rustfs. RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enables unauthorized file uploads exceeding size limits, uploads to arbitrary object keys, and content-type spoofing, potentially leading to storage exhaustion, unauthorized data access, and security bypass
Know when Rustfs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enables unauthorized file uploads exceeding size limits, uploads to arbitrary object keys, and content-type spoofing, potentially leading to storage exhaustion, unauthorized data access, and security bypasses. Version 1.0.0-alpha.83 fixes the issue.
Executive ViewAI
RustFS distributed storage systems running versions 1.0.0-alpha.56 through 1.0.0-alpha.82 contain a critical validation bypass that allows attackers to circumvent upload security policies, potentially enabling unauthorized file uploads, oversized content injection, and content-type spoofing. Any organization using affected RustFS versions for object storage faces immediate risk of data integrity compromise and potential malware distribution through presigned POST upload mechanisms.
Disable presigned POST uploads and require authenticated direct API calls only; implement WAF rules to validate and enforce Content-Type headers and Content-Length ranges before reaching RustFS; restrict upload endpoint access via network segmentation and IP allowlisting; deploy robust audit logging and anomaly detection on upload activities; consider temporary migration of presigned upload workflows to alternative storage systems until patch availability is confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Affected Products (CPE)GitHub Advisory
RustFS (alpha.13 to alpha.78) has a privilege escalation where restricted service accounts can self-issue unrestricted c
Stored XSS in RustFS distributed object storage system before 1.0.0-alpha.83. Malicious JavaScript persists in stored ob
Incorrect IAM permission validation in RustFS prior to version 1.0.0-alpha.79 permits principals with export-only permis
Path traversal in the RustFS /rustfs/rpc/read_file_stream endpoint allows an attacker to read arbitrary files from the h
RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79 expose the shared HMAC secret in server logs when processing invali
Authentication bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) allows unauthenticated remot
RustFS is a distributed object storage system built in Rust. [CVSS 4.0 MEDIUM]
Privilege escalation in RustFS distributed object storage before 1.0.0-beta.2 lets a low-privileged user holding ImportI
Stored cross-site scripting in RustFS Console (0.1.7 through 0.1.9) lets an attacker upload an HTML payload disguised as
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccount
Unauthenticated denial of service and information disclosure in RustFS distributed object storage prior to version 1.0.0
License-enforcement bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) stems from a hardcoded
Exploit-DB