EUVD-2026-57227Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
S3 API is network-reachable with low complexity; exploitation requires a valid IAM credential (PR:L); impact is confidentiality-only via historical version disclosure with no integrity or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known historical object content. This issue is fixed in version 1.0.0-beta.11.
AnalysisAI
Versioned object access control bypass in RustFS allows authenticated principals holding only s3:GetObject permission to read historical object versions by supplying an explicit versionId parameter on GetObject, CopyObject source, or UploadPartCopy source requests. The authorization boundary in access.rs conflated two distinct IAM actions - s3:GetObject and s3:GetObjectVersion - by always evaluating versioned reads against the former, effectively collapsing a privileged historical-version operation into an ordinary current-object read. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated IAM principal holding at least s3:GetObject permission on the target bucket or object prefix - unauthenticated access is not possible, as confirmed by PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately characterizes the threat profile: the attack is network-accessible with low complexity, requires only a low-privilege IAM credential, and produces high confidentiality impact while leaving integrity and availability unaffected. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An IAM principal configured with s3:GetObject but explicitly denied s3:GetObjectVersion sends a standard GetObject HTTP request to RustFS with a known versionId query parameter targeting a sensitive historical object version. RustFS evaluates the IAM check against s3:GetObject rather than s3:GetObjectVersion, the principal passes authorization, and the historical object content is returned in the response body. … |
| Remediation | Upgrade RustFS to version 1.0.0-beta.11 or later, which contains the corrected authorization logic applied across all three affected code paths in `rustfs/src/storage/access.rs`, as detailed in PR #5142 (https://github.com/rustfs/rustfs/pull/5142) and commit 81665617029e5e437ecf9dc70d8dcbbbf80cdbd1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
RustFS (alpha.13 to alpha.78) has a path traversal in /rustfs/rpc/read_file_stream that allows reading arbitrary files o
RustFS (alpha.13 to alpha.78) has a privilege escalation where restricted service accounts can self-issue unrestricted c
Stored XSS in RustFS distributed object storage system before 1.0.0-alpha.83. Malicious JavaScript persists in stored ob
Incorrect IAM permission validation in RustFS prior to version 1.0.0-alpha.79 permits principals with export-only permis
RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79 expose the shared HMAC secret in server logs when processing invali
Authentication bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) allows unauthenticated remot
Privilege escalation in RustFS distributed object storage before 1.0.0-beta.2 lets a low-privileged user holding ImportI
Unauthenticated denial of service and information disclosure in RustFS distributed object storage prior to version 1.0.0
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccount
License-enforcement bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) stems from a hardcoded
Cross-tenant object injection in RustFS 1.0.0-beta.4 lets a tenant holding only PutObject rights on their own bucket wri
Information disclosure in RustFS, a Rust-based distributed object storage system, lets any authenticated user with no ef
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today