EUVD-2026-57235Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AC:H reflects that exploitation requires two specific operator-configured conditions simultaneously present, which are beyond attacker control and constitute a narrow non-default configuration.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy_allowed path applies deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets, so a bucket that permits anonymous listing can continue exposing version listings after an operator enables the public-access control. The bypass affects GET /<bucket>?versions= and can disclose object version metadata even though equivalent GetObject requests are denied. This issue is fixed in version 1.0.0-beta.12.
AnalysisAI
Object version metadata exposure in RustFS allows anonymous HTTP clients to enumerate all stored object versions via GET /<bucket>?versions= even after an operator enables RestrictPublicBuckets. The authorization fallback in rustfs/src/storage/access.rs grants listing through an s3:ListBucket check but returns before applying the public-access block controls, silently contradicting the operator's intent to restrict anonymous access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two simultaneous operator-configured conditions must be present: (1) the target bucket must have a bucket policy that explicitly grants s3:ListBucket to anonymous principals (Principal: "*"), and (2) the operator must have separately enabled RestrictPublicBuckets via put_public_access_block on that same bucket. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects unauthenticated network access with limited confidentiality impact - only version metadata is exposed, not object contents, since GetObject requests are correctly denied. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An anonymous attacker who knows or guesses the name of a RustFS bucket sends a GET request to /<bucket>?versions= against an instance where the bucket policy contains an s3:ListBucket Allow for all principals and the operator has enabled RestrictPublicBuckets. The server returns HTTP 200 with an XML body listing all object version IDs, keys, last-modified timestamps, and ETags - data the operator intended to block - while a parallel GetObject request for the same bucket is correctly denied with HTTP 403. … |
| Remediation | Upgrade to RustFS 1.0.0-beta.12, which corrects the authorization fallback path so that RestrictPublicBuckets and deny_anonymous_table_data_plane_if_needed are applied consistently to ListObjectVersions requests. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
RustFS (alpha.13 to alpha.78) has a path traversal in /rustfs/rpc/read_file_stream that allows reading arbitrary files o
RustFS (alpha.13 to alpha.78) has a privilege escalation where restricted service accounts can self-issue unrestricted c
Stored XSS in RustFS distributed object storage system before 1.0.0-alpha.83. Malicious JavaScript persists in stored ob
Incorrect IAM permission validation in RustFS prior to version 1.0.0-alpha.79 permits principals with export-only permis
RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79 expose the shared HMAC secret in server logs when processing invali
Authentication bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) allows unauthenticated remot
Privilege escalation in RustFS distributed object storage before 1.0.0-beta.2 lets a low-privileged user holding ImportI
Unauthenticated denial of service and information disclosure in RustFS distributed object storage prior to version 1.0.0
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccount
License-enforcement bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) stems from a hardcoded
Cross-tenant object injection in RustFS 1.0.0-beta.4 lets a tenant holding only PutObject rights on their own bucket wri
Information disclosure in RustFS, a Rust-based distributed object storage system, lets any authenticated user with no ef
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today