RustFS CVE-2026-73287

Exploitation requires valid FTPS credentials (authenticated access) to a RustFS server running a version prior to 1.0.0-beta.12. The bypass is triggered exclusively via the FTPS protocol's MKD command - S3 API calls to create buckets are not affected by this specific flaw. The vulnerability is only security-relevant in deployments where bucket creation is explicitly restricted for some users via policy (i.e., users whose policies deny s3:CreateBucket). In deployments where FTPS is disabled, all authenticated users are permitted to create buckets, or no per-user bucket creation policies are enforced, there is no meaningful security impact. Exploitation is limited to the specific authenticated user's session scope - it does not grant access to existing buckets, their contents, or other users' resources.

The provided CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) accurately characterizes this as a medium-severity issue. The PR:L metric confirms that unauthenticated exploitation is not possible - an attacker must first possess valid FTPS credentials, which substantially narrows the attack surface. The integrity impact (I:L) reflects unauthorized namespace modification (bucket creation); there is no confidentiality exposure. The A:L metric in the provided vector may reflect potential storage quota exhaustion from spurious bucket creation, though this is indirect. No EPSS data was provided, precluding probability-of-exploitation quantification. KEV status is absent, and no POC has been identified, making this a theoretical-but-confirmed vulnerability rather than an actively weaponized one. Real-world priority is high specifically for multi-tenant RustFS deployments that rely on per-user bucket creation restrictions as a security boundary; for single-tenant or fully-trusted deployments the practical impact is negligible.

An authenticated FTPS user whose account is explicitly denied s3:CreateBucket in their IAM-style policy connects to a pre-1.0.0-beta.12 RustFS server using any standard FTPS client and issues an MKD command naming a new bucket. The FtpsDriver::mkd function calls storage.create_bucket directly, skipping the authorization check, and the bucket is created successfully. No public POC has been identified, but exploitation requires only valid FTPS credentials and a standard FTPS client.