RustFS CVE-2026-55838

The attacker must hold at least one valid IAM credential for the target RustFS cluster - unauthenticated exploitation is not possible, as confirmed by PR:L in the CVSS vector. No special configuration is required: the metrics endpoint is present and unprotected by default in all affected versions, meaning any deployment running 1.0.0-beta.7 or earlier with any IAM user provisioned is technically exposed. The primary limiting factor is the authentication prerequisite - a fully external, unauthenticated attacker cannot exploit this. Exploitation impact is further bounded to read-only operational telemetry; no user-stored object data, credentials, or write capability is accessible through this endpoint.

The NVD CVSS 3.1 score of 4.3 (Medium) accurately captures the constrained impact: network-reachable (AV:N), low complexity (AC:L), but gated behind valid IAM credentials (PR:L), with only limited confidentiality disclosure (C:L) and no integrity or availability consequence. The exposed data is operational telemetry - not user data or credentials - which bounds the real-world harm to insider threats or compromised low-privilege accounts mapping cluster topology. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified; the absence of a KEV listing and any identified POC further suggests this has not seen active exploitation. Given RustFS is a beta-stage product with limited production footprint, the realistic population of exploitable deployments is small. This is a genuine but low-urgency finding: the CVSS score and real-world risk are well-aligned, and defenders can deprioritize it relative to unauthenticated or high-impact vulnerabilities, while still treating it as a meaningful authorization control gap.

An attacker with any valid RustFS IAM credential - such as a developer account scoped to a single bucket - sends an authenticated HTTP GET request to /rustfs/admin/v3/metrics. Because MetricsHandler skips validate_admin_request, the server returns full cluster telemetry including disk I/O rates, network throughput figures, scanner cycle timing, and RPC state without raising an authorization error. The attacker uses this data to profile cluster capacity and identify optimal conditions for a follow-on attack or insider data exfiltration campaign.