RustFS CVE-2026-73285

Exploitation requires two simultaneous non-default conditions: (1) OPA external authorization must be explicitly enabled by an operator via the RUSTFS_POLICY_PLUGIN_URL environment variable - this is not set by default and represents a deliberate architectural choice; and (2) at least one IAM policy in the deployment must use s3:ExistingObjectTag/* conditions as access control gates on objects or operations. Additionally, the attacker must possess valid RustFS credentials (PR:L); unauthenticated exploitation is not possible. The vulnerability does not affect deployments running built-in IAM-only authorization. Exploitation is further scoped to objects and operations whose access controls rely specifically on ExistingObjectTag conditions - policies based on other condition keys (source IP, request time, string-match on bucket name) are unaffected. The combination of required configuration and required credential possession makes AC:H and PR:L the binding constraints for realistic exploitation.

The vendor-assigned CVSS 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is well-calibrated. AC:H accurately reflects that exploitation requires a non-default operator configuration (OPA enabled via RUSTFS_POLICY_PLUGIN_URL) combined with tag-based IAM policies - neither of which is a default RustFS deployment state. PR:L correctly captures that valid credentials are required; unauthenticated exploitation is not possible. The C:H/I:H/A:H impact reflects that a bypass of tag-based conditions can affect any S3 operation (GetObject, PutObject, DeleteObject) on restricted objects. EPSS data is not provided in the input and cannot be inferred. This CVE is not listed in CISA KEV, and no POC code has been identified, indicating no confirmed or widespread active exploitation at time of analysis. Real-world risk is further tempered by RustFS's limited production footprint as a pre-1.0 project. Deployments without OPA configured are completely unaffected - this is a targeted risk for organizations that specifically adopted OPA-based ABAC in RustFS.

An authenticated RustFS user with standard low-privilege credentials targets a bucket where sensitive objects are protected exclusively by an s3:ExistingObjectTag condition - for example, a policy denying GetObject unless the object carries the tag classification=public. The user issues a standard S3 GetObject request via any S3-compatible client; because OPA receives the policy evaluation request without the ExistingObjectTag context values, the condition evaluates as if no tag restriction exists and access is granted. The attacker can then read, overwrite, or delete any object whose access controls rely on ExistingObjectTag conditions across the deployment. No public exploit code has been identified, but exploitation requires only standard S3 API calls once valid credentials and knowledge of the policy structure are available.