Which versions of RustFS are affected by CVE-2026-45042?

RustFS versions prior to 1.0.0-beta.2 contain an authorization bypass in the UploadPartCopy operation that allows authenticated users to circumvent bucket policies and perform unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-45042?

24 hours: Audit all RustFS deployments; review S3-compatible access logs for UploadPartCopy operations and cross-bucket copy activity; identify sensitive and multi-tenant buckets. 7 days: Restrict UploadPartCopy operation to essential principals only via API gateway or middleware controls; implement network segmentation between sensitive buckets where feasible. 30 days: Monitor vendor advisory for RustFS 1.0.0 release and patch availability; develop deployment plan for patched version once released; evaluate alternative S3-compatible solutions if patch timeline exceeds risk tolerance.

RustFS CVE-2026-45042

Q: What is the CVSS score of CVE-2026-45042?

CVE-2026-45042 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32995 HIGH

Incorrect Authorization (CWE-863)

2026-05-28 GitHub_M

Authentication Bypass Rustfs

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 28, 2026 - 20:02 EUVD

Analysis Generated

May 28, 2026 - 19:28 vuln.today

CVSS changed

May 28, 2026 - 19:22 NVD

7.1 (HIGH)

DescriptionGitHub Advisory

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper authorization in the UploadPartCopy operation allows copying objects across buckets without enforcing destination bucket restrictions on allowed copy sources. The implementation validates GetObject permission on the source bucket and PutObject on the destination bucket independently, but does not enforce any policy constraints on whether the destination bucket permits the specified copy source. This enables unauthorized cross-bucket data movement. This vulnerability is fixed in 1.0.0-beta.2.

AnalysisAI

Improper authorization in RustFS prior to 1.0.0-beta.2 allows authenticated users to perform unauthorized cross-bucket object copies via the S3-compatible UploadPartCopy operation, bypassing destination-bucket policy constraints on permitted copy sources. The Rust-based distributed object storage system validates GetObject on the source and PutObject on the destination independently but never checks whether the destination bucket actually permits the specified source, enabling lateral data movement between buckets. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

RustFS is a distributed, S3-compatible object storage system implemented in Rust and identified by CPE cpe:2.3:a:rustfs:rustfs. The flaw is a CWE-863 (Incorrect Authorization) defect in the multipart-upload UploadPartCopy handler, which is the S3 API used to copy byte ranges from an existing object into a part of an in-progress multipart upload. In a correct S3 implementation, bucket policies on the destination can constrain the allowed x-amz-copy-source values (for example, restricting copies to objects from a specific source bucket or prefix). RustFS instead evaluates only two independent ACL checks - GetObject on the caller's source reference and PutObject on the destination - and never reconciles the destination bucket's source-copy policy, collapsing what should be a joint authorization decision into two disjoint ones.

RemediationAI

Upgrade to the vendor-released patched version RustFS 1.0.0-beta.2 or later, which corrects the UploadPartCopy authorization logic per the project advisory at https://github.com/rustfs/rustfs/security/advisories/GHSA-wfxj-ph3v-7mjf. If immediate upgrade is not possible, compensating controls include denying the s3:PutObject action when the request includes an x-amz-copy-source header via a gateway/reverse-proxy rule (which blocks all server-side copies and breaks legitimate multipart-copy workflows), tightening IAM so that no principal simultaneously holds GetObject on cross-tenant source buckets and PutObject on policy-restricted destinations, and auditing existing buckets for objects that may already have been copied in via UploadPartCopy. Each workaround sacrifices native S3 copy functionality, so apply only until the upgrade is rolled out.