What is the CVSS score of CVE-2026-49991?

CVE-2026-49991 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of RustFS are affected by CVE-2026-49991?

RustFS 1.0.0-beta.4 contains a critical flaw in its multi-tenant isolation controls that allows users with standard bucket permissions to write arbitrary objects into other tenants' buckets, directly…

How to fix or mitigate CVE-2026-49991?

Within 24 hours: Identify all RustFS 1.0.0-beta.4 deployments in production and audit recent Snowball archive extraction operations for unauthorized cross-tenant object writes. Within 7 days: Disable the Snowball auto-extract feature and harden IAM policies to require explicit per-tenant bucket access controls; audit and remove any wildcard-based permission rules. Within 30 days: Coordinate with RustFS vendor on patch timeline; if no patch is released by 2026-07-26, initiate migration planning to an alternative object storage system with verified multi-tenant isolation.

RustFS CVE-2026-49991

EUVD-2026-39865 HIGH

Path Traversal (CWE-22)

2026-06-26 GitHub_M

Path Traversal Rustfs

8.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

vuln.today AI

7.7 HIGH

Description requires an authenticated tenant with PutObject, so PR:L not PR:N; write-only cross-tenant impact gives I:H with C:N/A:N and S:C for the boundary crossing.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 20:36 vuln.today

DescriptionCVE.org

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry key normalization; IAM wildcard matching uses raw (uncleaned) paths; and Filesystem path cleaning resolves ../ across bucket boundaries.

AnalysisAI

Cross-tenant object injection in RustFS 1.0.0-beta.4 lets a tenant holding only PutObject rights on their own bucket write arbitrary objects into other tenants' buckets, fully breaking multi-tenant isolation. The flaw lives in the Snowball auto-extract feature and chains three weaknesses (unsanitized tar entry keys, IAM wildcard matching on raw paths, and filesystem path cleaning that resolves ../ across bucket boundaries). No public exploit is identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

RustFS is a distributed, S3-compatible object storage system written in Rust. The vulnerability is a CWE-22 path traversal that manifests in the Snowball bulk-import/auto-extract feature, which unpacks uploaded tar archives server-side. Three compounding root causes enable the break: (1) tar entry keys are normalized without stripping ../ sequences, (2) IAM authorization performs wildcard/prefix matching against the raw, uncleaned object path so the policy check is evaluated before traversal is resolved, and (3) the filesystem layer then cleans ../ in a way that escapes the intended bucket directory boundary. The order of operations matters: authorization sees a compliant path while the filesystem resolves a different, attacker-chosen destination. CPE coverage is cpe:2.3:a:rustfs:rustfs:*:*:*:*:*:*:*:*, with the advisory naming 1.0.0-beta.4 as affected.

RemediationAI

No vendor-released patched version is identified in the available data; consult the GitHub Security Advisory GHSA-f4vq-9ffr-m8m3 (https://github.com/rustfs/rustfs/security/advisories/GHSA-f4vq-9ffr-m8m3) for the fixed release and upgrade off 1.0.0-beta.4 once it is published. As immediate compensating controls, disable the Snowball auto-extract/bulk-import feature so server-side tar unpacking cannot be triggered (trade-off: tenants lose bulk-upload convenience), and restrict or gate which tenants may invoke Snowball to trusted principals only. Additionally, tighten IAM policies to avoid broad wildcard resource matches and, where possible, run tenants on separate storage backends or namespaces so a traversal cannot reach another tenant's directory (trade-off: higher operational overhead and reduced storage density).