EUVD-2026-57234Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
AC:H because exploitation depends on non-default policy configurations using negated set-qualifier operators; PR:L because authentication is required per description and CVSS input.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's semantics because crates/policy/src/policy/function/string.rs negates the aggregate result after eval or eval_like instead of negating each request-value predicate before quantification. Partially overlapping policy and request value sets can therefore make an Allow condition grant access to an excluded principal or make a Deny guardrail fail, including policies based on jwt:groups and jwt:roles; absent keys also receive the opposite ForAllValues: and ForAnyValue: behavior. This issue is fixed in version 1.0.0-beta.12.
AnalysisAI
Policy engine logic in RustFS incorrectly swaps ForAllValues: and ForAnyValue: set-qualifier semantics when paired with negated condition operators (StringNotEquals, StringNotLike, ArnNotEquals, ArnNotLike, StringNotEqualsIgnoreCase), allowing authenticated low-privilege users to bypass IAM-style access controls in versions prior to 1.0.0-beta.12. The root cause is that negation is applied to the aggregate quantifier result rather than to each individual request-value predicate before quantification, meaning partially overlapping policy and request value sets can cause an explicit Deny guardrail to evaluate as Allow - including policies controlling access via jwt:groups and jwt:roles claims. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target RustFS deployment has at least one IAM policy using ForAllValues: or ForAnyValue: set qualifiers in combination with one of the five negated operators: StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, or ArnNotLike. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network-accessible exploitation requiring only low-privilege authentication, with high confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated low-privilege user identifies that a restrictive Deny policy uses ForAllValues:StringNotEquals on the jwt:groups condition key to exclude their group from a sensitive bucket. Because the policy engine incorrectly negates the aggregate result rather than each predicate, submitting a request with a jwt:groups claim that partially overlaps the excluded set causes the Deny evaluation to return the wrong boolean, and the request is permitted instead of denied. … |
| Remediation | Upgrade to RustFS 1.0.0-beta.12 or later; the patched release is available at https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.12, corresponding to commit 92f83bfe155d8a3b9cdd903086e5b28d52339efb. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all RustFS deployments and document any policies using negated set-qualifier operators (StringNotEquals, StringNotLike, ArnNotEquals, ArnNotEqualsIgnoreCase), particularly for jwt:groups and jwt:roles claims. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
RustFS (alpha.13 to alpha.78) has a path traversal in /rustfs/rpc/read_file_stream that allows reading arbitrary files o
RustFS (alpha.13 to alpha.78) has a privilege escalation where restricted service accounts can self-issue unrestricted c
Stored XSS in RustFS distributed object storage system before 1.0.0-alpha.83. Malicious JavaScript persists in stored ob
Incorrect IAM permission validation in RustFS prior to version 1.0.0-alpha.79 permits principals with export-only permis
RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79 expose the shared HMAC secret in server logs when processing invali
Authentication bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) allows unauthenticated remot
Privilege escalation in RustFS distributed object storage before 1.0.0-beta.2 lets a low-privileged user holding ImportI
Unauthenticated denial of service and information disclosure in RustFS distributed object storage prior to version 1.0.0
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccount
License-enforcement bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) stems from a hardcoded
Cross-tenant object injection in RustFS 1.0.0-beta.4 lets a tenant holding only PutObject rights on their own bucket wri
Information disclosure in RustFS, a Rust-based distributed object storage system, lets any authenticated user with no ef
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today