EUVD-2026-57229Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
OPA must be explicitly operator-configured (AC:H); valid credentials required (PR:L); all three impacts high as any tagged-object S3 operation can be bypassed.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs_existing_object_tag incorrectly for PreparedIamMode::Opa, causing maybe_merge_object_tag_conditions to omit s3:ExistingObjectTag/* values and allowing authenticated users to bypass tag-based policy restrictions. This issue is fixed in version 1.0.0-rc.1.
AnalysisAI
Tag-based S3 policy bypass in RustFS distributed object storage allows authenticated users on versions 1.0.0-alpha.64 through pre-rc.1 to circumvent object-level access controls when OPA external authorization is active. The IAM subsystem incorrectly initializes PreparedIamAuth.needs_existing_object_tag for the OPA mode, causing maybe_merge_object_tag_conditions to silently omit s3:ExistingObjectTag/* condition values from policy evaluation - meaning any policy restriction keyed on object tags is effectively ignored. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous non-default conditions: (1) OPA external authorization must be explicitly enabled by an operator via the RUSTFS_POLICY_PLUGIN_URL environment variable - this is not set by default and represents a deliberate architectural choice; and (2) at least one IAM policy in the deployment must use s3:ExistingObjectTag/* conditions as access control gates on objects or operations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated RustFS user with standard low-privilege credentials targets a bucket where sensitive objects are protected exclusively by an s3:ExistingObjectTag condition - for example, a policy denying GetObject unless the object carries the tag classification=public. The user issues a standard S3 GetObject request via any S3-compatible client; because OPA receives the policy evaluation request without the ExistingObjectTag context values, the condition evaluates as if no tag restriction exists and access is granted. … |
| Remediation | Upgrade to RustFS version 1.0.0-rc.1, which resolves the issue via commit 98d3619613722308498494d412797a52ea8ae64d (https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d); the release is available at https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, enumerate all RustFS instances running versions 1.0.0-alpha.64 through pre-rc.1 with OPA external authorization enabled and prioritize them by data sensitivity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
RustFS (alpha.13 to alpha.78) has a path traversal in /rustfs/rpc/read_file_stream that allows reading arbitrary files o
RustFS (alpha.13 to alpha.78) has a privilege escalation where restricted service accounts can self-issue unrestricted c
Stored XSS in RustFS distributed object storage system before 1.0.0-alpha.83. Malicious JavaScript persists in stored ob
Incorrect IAM permission validation in RustFS prior to version 1.0.0-alpha.79 permits principals with export-only permis
RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79 expose the shared HMAC secret in server logs when processing invali
Authentication bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) allows unauthenticated remot
Privilege escalation in RustFS distributed object storage before 1.0.0-beta.2 lets a low-privileged user holding ImportI
Unauthenticated denial of service and information disclosure in RustFS distributed object storage prior to version 1.0.0
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccount
License-enforcement bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) stems from a hardcoded
Cross-tenant object injection in RustFS 1.0.0-beta.4 lets a tenant holding only PutObject rights on their own bucket wri
Information disclosure in RustFS, a Rust-based distributed object storage system, lets any authenticated user with no ef
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today