CVE-2026-27822

CRITICAL
2026-02-25 [email protected] GHSA-v9fg-3cr2-277j
9.0
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Patch Released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
PoC Detected
Feb 25, 2026 - 15:36 vuln.today
Public exploit code
CVE Published
Feb 25, 2026 - 03:16 nvd
CRITICAL 9.0

Tags

XSS Rustfs

Description

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an attacker can steal administrator credentials from `localStorage`, leading to full account takeover and system compromise. Version 1.0.0-alpha.83 fixes the issue.

Analysis

Stored XSS in RustFS distributed object storage system before 1.0.0-alpha.83. Malicious JavaScript persists in stored objects and executes when accessed. …

Sign in for full analysis, threat intelligence, and remediation guidance.

Remediation

Within 24 hours: Immediately inventory all RustFS deployments and restrict console access to trusted networks only; implement enhanced monitoring for suspicious administrative activity. Within 7 days: Evaluate upgrade feasibility to version 1.0.0-alpha.83 or later; deploy WAF rules to filter malicious script payloads in console requests. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Priority Score

65
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +45
POC: +20

Share

CVE-2026-27822 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy