EUVD-2026-33285Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain RustFS account with ImportIAMAction
-
DeliveryReach admin API over network
-
ExploitPUT crafted import-iam JSON with parent=minioadmin
-
ExecutionServer registers attacker-controlled root service account
-
PersistAuthenticate using planted accessKey/secretKey
-
ImpactExercise full administrative control over buckets and IAM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must already hold a valid RustFS account whose IAM policy grants the ImportIAMAction permission, and must have network reachability to the RustFS admin API endpoint PUT /rustfs/admin/v3/import-iam (typically port 9000 or the configured admin listener). No user interaction is required and no special non-default configuration is needed beyond ImportIAMAction being granted to a non-root principal - which is the realistic limiting factor, since environments that reserve this action for the root user alone cannot be exploited remotely. Exploitation is constrained to RustFS deployments running a version below 1.0.0-beta.2. |
| Impact | Signals are consistently elevated but not yet confirmed in the wild. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H and subsequent-system impact SC:H/SI:H indicates a network-reachable, low-complexity, no-user-interaction attack that breaches scope to compromise the broader system once root credentials are minted - justifying the 9.3 score. PR:L is the key gating factor: an attacker must already hold the ImportIAMAction permission, so this is a privilege-escalation primitive rather than an unauthenticated takeover, which dampens mass-exploitation potential. EPSS and CISA KEV data were not provided, and no POC is referenced, so real-world exploitation is currently unproven; however, the attack is highly automatable once the endpoint is reachable and a foothold account exists, and the impact (persistent root-equivalent service account) makes it a high-priority patch for any RustFS operator with multi-tenant or delegated IAM usage. |
| Exploit ScenarioDerived | An attacker who has obtained or been granted a low-tier RustFS account carrying the ImportIAMAction permission sends a single authenticated PUT to /rustfs/admin/v3/import-iam with a JSON body specifying parent='minioadmin' and a chosen accessKey/secretKey. The server stores the new service account under the root identity, and the attacker immediately authenticates with the planted credentials to read, modify, or exfiltrate every bucket, install a durable backdoor identity, and pivot to other systems trusting RustFS-issued tokens. No POC has been published at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 29, 2026
Privilege escalation in RustFS distributed object storage before 1.0.0-beta.2 lets a low-privileged user holding ImportIAMAction abuse the PUT /rustfs/admin/v3/import-iam endpoint to mint service accounts under arbitrary parent identities - including the root minioadmin user - granting full administrative control via attacker-chosen, persistent credentials. CVSS 4.0 scores this 9.3 (Critical) reflecting low attack complexity, low privileges, and high confidentiality/integrity impact with scope change. No public exploit identified at time of analysis, and no EPSS or KEV signal is provided.
RemediationAI
Vendor-released patch: 1.0.0-beta.2 - upgrade RustFS to 1.0.0-beta.2 or later as the primary fix, per the GHSA-566f-q62r-wcr8 advisory (https://github.com/rustfs/rustfs/security/advisories/GHSA-566f-q62r-wcr8). If immediate upgrade is not possible, revoke the ImportIAMAction permission from every non-root principal and audit existing IAM policies for grants of that action (trade-off: bulk IAM import workflows will break and must be performed by the root account). Additionally, block external access to the /rustfs/admin/v3/import-iam endpoint at the reverse proxy or network layer and restrict the admin API to a management VLAN or mTLS-protected interface (trade-off: legitimate remote administration tooling will need network-path or certificate updates). After patching, enumerate all service accounts whose parent is minioadmin or another privileged identity, validate provenance, and rotate or delete any unrecognized accessKey/secretKey pairs that may have been planted pre-patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RustFS is a Rust-implemented, S3-compatible distributed object storage system whose IAM model mirrors MinIO conventions (root user 'minioadmin', service accounts tied to parent identities, action-based policy grants like ImportIAMAction). The flaw sits in the admin import-IAM REST handler, which deserializes user-supplied JSON fields (parent, claims, accessKey, secretKey) and persists them as a service account without verifying that the requester is authorized to act on behalf of the named parent. This is a textbook CWE-269 (Improper Privilege Management) issue: the boundary check that should ensure a caller can only create accounts under identities they already own is missing, so possession of one narrow IAM permission collapses the entire trust hierarchy. The affected product is identified by CPE cpe:2.3:a:rustfs:rustfs across all versions prior to the fix.
Know when Rustfs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper validation in the PUT /rustfs/admin/v3/import-iam endpoint allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). The endpoint accepts attacker-controlled parent, claims, accessKey, and secretKey values without enforcing privilege boundaries or sanitization. This enables privilege escalation to full administrative access using a persistent, attacker-defined credential. This vulnerability is fixed in 1.0.0-beta.2.
Executive ViewAI
RustFS distributed object storage versions before 1.0.0-beta.2 contain a critical privilege escalation flaw that allows low-privileged users to create permanent administrative service accounts, resulting in complete unauthorized access to storage systems and all protected data. Organizations using vulnerable RustFS versions face immediate risk of data compromise and infrastructure takeover.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
RustFS (alpha.13 to alpha.78) has a privilege escalation where restricted service accounts can self-issue unrestricted c
Stored XSS in RustFS distributed object storage system before 1.0.0-alpha.83. Malicious JavaScript persists in stored ob
Incorrect IAM permission validation in RustFS prior to version 1.0.0-alpha.79 permits principals with export-only permis
Path traversal in the RustFS /rustfs/rpc/read_file_stream endpoint allows an attacker to read arbitrary files from the h
RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79 expose the shared HMAC secret in server logs when processing invali
Authentication bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) allows unauthenticated remot
RustFS is a distributed object storage system built in Rust. [CVSS 4.0 MEDIUM]
Stored cross-site scripting in RustFS Console (0.1.7 through 0.1.9) lets an attacker upload an HTML payload disguised as
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccount
Unauthenticated denial of service and information disclosure in RustFS distributed object storage prior to version 1.0.0
License-enforcement bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) stems from a hardcoded
Cross-tenant object injection in RustFS 1.0.0-beta.4 lets a tenant holding only PutObject rights on their own bucket wri
Exploit-DB