RustFS EUVD-2026-39864

Exploitation requires that the RustFS FTP frontend be enabled (a non-default deployment choice) and that the attacker can authenticate to the FTP listener with valid credentials (PR:L). Given those, no further conditions apply: the RETR/SIZE/MDTM/CWD handlers bypass IAM unconditionally, so even an account carrying an explicit Deny on s3:GetObject succeeds against any bucket or object. Limiting factors that reduce real-world risk: the FTP frontend must be turned on, the attacker must already possess a working FTP login, and only read/stat/probe operations are affected (no write, delete, or integrity impact). Deployments running only the HTTP S3 API are not exploitable.

The CVSS 3.1 base score is 7.7 (High) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N: network-reachable, low complexity, requires only low privileges (a valid FTP credential), no user interaction, and a scope change because the bug lets an authenticated low-privilege user cross the IAM authorization boundary into data they were explicitly denied. Confidentiality impact is High while integrity and availability are None - consistent with read/stat-only access (no write or delete). No EPSS probability, KEV status, or SSVC decision was supplied, so widespread or automated exploitation cannot be assessed from the data; the realistic risk is concentrated in deployments that actually enable the FTP frontend and that rely on IAM Deny policies for tenant isolation. For those, this is a genuine confidentiality priority because it silently defeats explicit Deny rules; for deployments with the FTP frontend disabled, exposure is effectively nil. The PR:L requirement (an attacker still needs to authenticate to the FTP listener) meaningfully limits blast radius versus an unauthenticated bug.

An attacker who holds (or obtains) any RustFS FTP credential-even an account whose IAM policy explicitly Denies s3:GetObject-connects to the FTP listener, uses CWD to enumerate buckets and SIZE/MDTM to locate objects, then issues RETR to download confidential objects from buckets they were never authorized to access. Given AV:N/AC:L, this requires only network reach to the FTP port and a single low-privilege login, with no special tooling; no public exploit code has been identified at time of analysis.