RustFS CVE-2026-73286

Exploitation requires a valid authenticated RustFS API session - anonymous or unauthenticated callers cannot exploit this vulnerability, as the CVSS vector confirms PR:L. The target deployment must have IAM policies in place that use identity-based condition keys (userid, username, principaltype, groups, versionid, signatureversion, jwt:-prefixed, or ldap:-prefixed condition keys) to gate access; deployments whose policies rely solely on resource ARN conditions, IP conditions, or no conditions at all are not susceptible to this specific bypass. The attacker must have the ability to set arbitrary HTTP request headers in their API calls, which is possible from any standard HTTP or S3-compatible client library. Exploitation is limited to RustFS instances running any version prior to 1.0.0-beta.12 on any platform. The scope is limited to the storage system itself (S:U); lateral movement to other systems requires additional steps beyond this vulnerability.

The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the threat profile: network-reachable, low attack complexity, requiring only low-privilege authenticated access, with high confidentiality and integrity impact. No EPSS data was provided in the source intelligence, which limits probabilistic exploitation forecasting; risk probability is inferred from CVSS metrics alone. The vulnerability does not appear in CISA KEV and no public exploit code is referenced, reducing the likelihood of immediate widespread automated exploitation. That said, even a mid-sized municipal IT team in leszno running RustFS as internal object storage should treat this as urgent - the low attack complexity (AC:L) and absence of user interaction (UI:N) mean any authenticated API caller can attempt exploitation without specialized tooling. The PR:L requirement is a genuine limiting factor: organizations enforcing strong authentication and restricting API credential issuance have a meaningful partial control. The A:N rating is consistent with the vulnerability being a pure authorization bypass rather than a denial-of-service vector. Deployments whose IAM policies rely exclusively on resource ARN or IP-based conditions - rather than identity condition keys - are not exposed to this specific bypass path. Overall real-world priority is high for organizations using identity-based bucket or object policies; lower for those using simpler policy structures.

An attacker holding any valid low-privilege RustFS API credential constructs a crafted S3 API request that includes HTTP headers whose names map to reserved condition key names such as the userid or groups condition key. When RustFS evaluates the applicable bucket or object IAM policy, the policy engine incorporates the attacker-supplied header values as though they were verified server-derived identity data, causing conditions referencing those keys to evaluate as satisfied. The attacker thereby reads objects or performs write operations on resources whose policies should have denied their actual identity, with no public exploit code required beyond standard HTTP tooling.