What is the CVSS score of EUVD-2026-39863?

EUVD-2026-39863 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

RustFS EUVD-2026-39863

| CVE-2026-55838 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 GitHub_M

Authentication Bypass Rustfs

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Valid IAM credential required (PR:L, AV:N); only operational telemetry disclosed (C:L); no write or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 20:35 vuln.today

DescriptionCVE.org

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessible to any valid IAM user regardless of their assigned policy. Every other admin handler in the codebase calls validate_admin_request to enforce admin-action IAM checks; the MetricsHandler skips this call entirely. A restricted IAM user whose policy grants only access to their own bucket can read server-wide operational metrics including disk I/O statistics, network throughput, scanner cycle timing, and cluster RPC state.

AnalysisAI

Unauthorized access to the admin metrics endpoint in RustFS 1.0.0-beta.7 and earlier allows any authenticated IAM user to read server-wide operational telemetry regardless of their assigned policy. The MetricsHandler for /rustfs/admin/v3/metrics omits the validate_admin_request call that every other admin handler enforces, exposing disk I/O statistics, network throughput, scanner cycle timing, and cluster RPC state to restricted users whose policies should grant no such visibility. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

RustFS is a distributed object storage system written in Rust, architecturally comparable to MinIO, designed for high-performance S3-compatible workloads. The vulnerability is rooted in CWE-862 (Missing Authorization), a broken access control class where a privileged endpoint lacks the security gate that peers enforce. The admin API at /rustfs/admin/v3/metrics exposes operational telemetry - disk I/O, network throughput, scanner cycle timings, and cluster RPC state - intended only for administrators. The codebase enforces admin IAM checks via a validate_admin_request function called consistently across all other admin handlers; MetricsHandler is the sole exception, making this a code-level omission rather than an architectural decision. All versions through 1.0.0-beta.7 are affected per CPE cpe:2.3:a:rustfs:rustfs:*:*:*:*:*:*:*:*.

RemediationAI

Consult the vendor advisory at https://github.com/rustfs/rustfs/security/advisories/GHSA-f5cv-v44x-2xgf to identify the patched release and upgrade as soon as one is confirmed; no specific fixed version number is available from the current intelligence data. As an interim compensating control, restrict access to the /rustfs/admin/v3/metrics endpoint at the network layer using a reverse proxy (e.g., nginx allow/deny directives) or firewall rules to permit only monitoring agents and administrator source IPs - this adds operational overhead for monitoring pipeline configuration but closes the authorization gap without code changes. Additionally, audit all IAM user policies to identify restricted accounts and enable access logging to detect unexpected requests to the metrics endpoint, which would indicate misuse.