What is the CVSS score of CVE-2026-55188?

CVE-2026-55188 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of RustFS are affected by CVE-2026-55188?

RustFS storage deployments are exposed to a HIGH severity credential disclosure vulnerability.

How to fix or mitigate CVE-2026-55188?

Within 24 hours: Identify all RustFS instances and their versions; temporarily disable bucket replication if non-critical. Within 7 days: Upgrade all instances running versions 1.0.0-alpha.1 through pre-1.0.0-beta.9 to version 1.0.0-beta.9 or later; rotate all replication access keys and secret keys across dependent systems. Within 30 days: Review system audit logs for unauthorized bucket replication API access; implement least-privilege access controls for bucket replication configuration endpoints.

RustFS CVE-2026-55188

EUVD-2026-39866 HIGH

Information Exposure (CWE-200)

2026-06-26 GitHub_M

Information Disclosure Rustfs

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

7.7 HIGH

Straightforward authenticated network API call (AC:L, PR:L); disclosed remote credentials affect a separate system (S:C, C:H), but this bug only reads data, so I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 20:36 vuln.today

DescriptionCVE.org

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an authenticated user with no effective bucket or admin permissions can list remote replication target configuration for a bucket. Because the returned BucketTarget objects include remote target credentials, this can disclose replication access keys and secret keys. This vulnerability is fixed in 1.0.0-beta.9.

AnalysisAI

Information disclosure in RustFS, a Rust-based distributed object storage system, lets any authenticated user with no effective bucket or admin permissions read remote replication target configuration via the bucket replication admin API. Because the returned BucketTarget objects embed remote credentials, an attacker can harvest replication access keys and secret keys for downstream systems. The flaw affects 1.0.0-alpha.1 through versions prior to 1.0.0-beta.9 and is fixed in 1.0.0-beta.9; no public exploit identified at time of analysis.

Technical ContextAI

RustFS is an S3-compatible distributed object storage engine implemented in Rust, with an administrative API surface for managing bucket replication to remote targets. The defect lies in the ListRemoteTargetHandler, which services requests to enumerate a bucket's remote replication targets. Per CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the root cause is a broken authorization check: the handler validates only that request credentials are present (authentication) but never confirms the caller holds replication or administrator authorization for the target bucket. The CPE cpe:2.3:a:rustfs:rustfs identifies the affected application across all listed pre-beta.9 versions. Because BucketTarget structures carry the access key and secret key used to authenticate to the remote replication endpoint, the missing authZ gate turns a routine listing call into a credential-disclosure primitive.

RemediationAI

Vendor-released patch: 1.0.0-beta.9 - upgrade all RustFS instances to 1.0.0-beta.9 or later, as documented in advisory GHSA-796f-j7xp-hwf4 (https://github.com/rustfs/rustfs/security/advisories/GHSA-796f-j7xp-hwf4). Because the exposed data is reusable credentials, treat any pre-patch exposure as a compromise and rotate the access keys and secret keys of every configured remote replication target after upgrading. If immediate patching is impossible, compensating controls include restricting which accounts can authenticate to the RustFS admin API and tightening IAM/policy so only trusted operators hold credentials at all (since the bug grants access to any authenticated principal, shrinking the set of authenticated users directly reduces the attack surface), and temporarily unconfiguring remote replication targets so no credentials are stored to leak (trade-off: replication stops, breaking cross-site data redundancy until restored). Network-restricting the admin API endpoint to a management subnet limits who can reach the handler but does not protect against an already-trusted authenticated insider.