What is the CVSS score of CVE-2026-27607?

CVE-2026-27607 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Rustfs are affected by CVE-2026-27607?

RustFS distributed storage systems running versions 1.0.0-alpha.56 through 1.0.0-alpha.82 contain a critical validation bypass that allows attackers to circumvent upload security policies,…. A patch is available.

How to fix or mitigate CVE-2026-27607?

Within 24 hours: Identify all RustFS deployments and document affected versions; disable presigned POST upload functionality if business-critical. Within 7 days: Implement network segmentation to restrict RustFS upload endpoints to authorized sources only; enable comprehensive audit logging on all upload activities. Within 30 days: Evaluate RustFS alternatives or await patch availability; if upgrading is not feasible, deploy WAF rules to enforce Content-Type and Content-Length validation at the perimeter.

Rustfs CVE-2026-27607

HIGH

Improper Input Validation (CWE-20)

2026-02-25 security-advisories@github.com

GHSA-w5fh-f8xh-5x3p

Code Injection Rustfs

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 25, 2026 - 03:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enables unauthorized file uploads exceeding size limits, uploads to arbitrary object keys, and content-type spoofing, potentially leading to storage exhaustion, unauthorized data access, and security bypasses. Version 1.0.0-alpha.83 fixes the issue.

AnalysisAI

Insufficient input validation in RustFS versions 1.0.0-alpha.56 through 1.0.0-alpha.82 allows authenticated attackers to circumvent presigned POST upload policy restrictions, bypassing content-length-range, starts-with, and Content-Type controls. An attacker can exploit this to upload oversized files, write to arbitrary object keys, and spoof file types, resulting in storage exhaustion and potential unauthorized data access.

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Affects Rustfs. RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enables unauthorized file uploads exceeding size limits, uploads to arbitrary object keys, and content-type spoofing, potentially leading to storage exhaustion, unauthorized data access, and security bypass

RemediationAI

Monitor vendor advisories for a patch. Validate file types by content. Store uploads outside web root. Restrict network access to the affected service where possible.