Rustfs CVE-2026-39360

The CVSS 5.3 score reflects a network-accessible vulnerability requiring low-level privileges (PR:L) with low confidentiality impact (VC:L). However, the real-world risk is elevated in multi-tenant deployments where tenant isolation is a core security boundary. The vulnerability is not passively exploitable-an attacker must be an authenticated user of the system-but the authentication barrier is low (any user with system access). The authorization bypass nature means the system is fundamentally exploitable once an attacker gains initial access. EPSS data is unavailable, but the practical impact in shared environments could be severe. This is not a remote code execution or system-wide compromise vector, but rather a data confidentiality breach affecting specific objects an attacker targets, making it a critical issue for operators of multi-tenant RustFS clusters even if CVSS scoring appears moderate.

An authenticated user in a multi-tenant RustFS cluster initiates a multipart upload to their own bucket, then uses UploadPartCopy to copy object parts from a victim bucket that they lack read permissions for. Because the authorization check is missing, the operation succeeds despite the user's access restrictions. The attacker completes the multipart upload, gaining persistent access to the victim's data. This attack requires the attacker to be an authenticated system user but no additional privileged access, making it readily exploitable in shared deployments.