RustFS CVE-2026-73265

Exploitation requires an authenticated IAM principal holding at least s3:GetObject permission on the target bucket or object prefix - unauthenticated access is not possible, as confirmed by PR:L in the CVSS vector. The RustFS deployment must have S3 object versioning enabled on the target bucket; without versioning, there are no historical versions to disclose. IAM policies must differentiate between s3:GetObject and s3:GetObjectVersion for the exposure to be meaningful - deployments that grant both actions uniformly are not further harmed. The attacker must know or be able to enumerate a valid versionId for a specific historical object; versionId discovery may require list-version permissions (s3:ListBucketVersions), which is an additional prerequisite if the versionId is not otherwise known. The bypass is limited strictly to confidentiality: no write, delete, or administrative capability is obtained through this flaw.

The CVSS 6.5 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately characterizes the threat profile: the attack is network-accessible with low complexity, requires only a low-privilege IAM credential, and produces high confidentiality impact while leaving integrity and availability unaffected. Real-world impact is bounded by two deployment prerequisites: object versioning must be enabled on the target bucket, and IAM policies must distinguish between s3:GetObject and s3:GetObjectVersion grants - environments that issue broad, undifferentiated S3 access see no effective exposure. EPSS data is absent from the provided intelligence, so a numerical exploitation probability cannot be stated. The vulnerability is not listed in CISA KEV. No public exploit code is identified. The PR diff confirms the flaw was straightforward to introduce and equally straightforward to exploit by any credential holder aware of a target versionId, suggesting low attack complexity in permissive-but-not-fully-permissive IAM environments.

An IAM principal configured with s3:GetObject but explicitly denied s3:GetObjectVersion sends a standard GetObject HTTP request to RustFS with a known versionId query parameter targeting a sensitive historical object version. RustFS evaluates the IAM check against s3:GetObject rather than s3:GetObjectVersion, the principal passes authorization, and the historical object content is returned in the response body. No exploit tooling beyond a standard S3-compatible client (e.g., aws-cli, boto3, or curl with the appropriate query string) is needed.