Rustfs
CVE-2026-27822
CRITICAL
GHSA-v9fg-3cr2-277j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryUpload malicious PDF with embedded XSS payload
-
ExploitBypass PDF preview sanitization logic
-
ExecutionExecute JavaScript in admin console context
-
PersistSteal localStorage credentials
-
ImpactAchieve full account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker requires valid RustFS Console login credentials (PR:L). Admin user must view the malicious PDF preview via the web interface (UI:R). RustFS versions prior to 1.0.0-alpha.83 with enabled PDF preview feature in the management console. |
| Impact | CVSS 9.0. Object storage systems serve content to many users — XSS affects all users viewing the malicious object. |
| Exploit ScenarioDerived | Attacker uploads object with XSS payload, other users viewing or downloading the object through the web interface have the JavaScript executed in their browser. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Stored XSS in RustFS distributed object storage system before 1.0.0-alpha.83. Malicious JavaScript persists in stored objects and executes when accessed. PoC available.
Earlier versions of this analysis (1)
Stored XSS in RustFS object storage.
RemediationAI
Update RustFS. Implement Content-Disposition headers to prevent inline rendering.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in cargo
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-79 stored XSS in object storage system. Uploaded objects containing JavaScript execute in the context of the RustFS web interface.
Know when Rustfs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an attacker can steal administrator credentials from localStorage, leading to full account takeover and system compromise. Version 1.0.0-alpha.83 fixes the issue.
Executive ViewAI
A critical stored XSS vulnerability in RustFS Console (CVE-2026-27822) allows attackers to execute malicious code within the management interface, potentially compromising administrative access and sensitive data. Any organization using RustFS prior to version 1.0.0-alpha.83 faces immediate risk of console takeover and unauthorized access to distributed storage systems.
Implement network segmentation to restrict RustFS Console access to authorized IP ranges only; deploy WAF with rules to sanitize XSS payloads (script tags, event handlers, javascript: protocol); disable RustFS Console if not actively used; enforce multi-factor authentication for all console access; implement real-time alerts for console login anomalies and script injection attempts; maintain detailed audit logging of all console activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)GitHub Advisory
RustFS (alpha.13 to alpha.78) has a privilege escalation where restricted service accounts can self-issue unrestricted c
Incorrect IAM permission validation in RustFS prior to version 1.0.0-alpha.79 permits principals with export-only permis
Path traversal in the RustFS /rustfs/rpc/read_file_stream endpoint allows an attacker to read arbitrary files from the h
RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79 expose the shared HMAC secret in server logs when processing invali
Authentication bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) allows unauthenticated remot
RustFS is a distributed object storage system built in Rust. [CVSS 4.0 MEDIUM]
Privilege escalation in RustFS distributed object storage before 1.0.0-beta.2 lets a low-privileged user holding ImportI
Stored cross-site scripting in RustFS Console (0.1.7 through 0.1.9) lets an attacker upload an HTML payload disguised as
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccount
Unauthenticated denial of service and information disclosure in RustFS distributed object storage prior to version 1.0.0
License-enforcement bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) stems from a hardcoded
Cross-tenant object injection in RustFS 1.0.0-beta.4 lets a tenant holding only PutObject rights on their own bucket wri
Exploit-DB