EUVD-2026-39865Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege tenant
-
DeliveryCraft tar with ../ traversal keys
-
ExploitUpload via Snowball auto-extract
-
ExecutionIAM check passes on raw path
-
PersistFilesystem resolves ../ across bucket boundary
-
ImpactWrite objects into victim tenant bucket
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated tenant account with at least PutObject permission on its own bucket, and the target RustFS instance must have the Snowball auto-extract (server-side tar unpacking) feature available and invokable by that tenant. Exploitation depends on the multi-tenant deployment model where bucket isolation is the security boundary being crossed; a single-tenant instance has no isolation to break. Limiting factors: the attacker must already hold valid tenant credentials (contradicting the vector's PR:N), and the Snowball ingest path must be enabled and reachable. No user interaction by a victim is needed. |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N, 8.6) and the prose description conflict on a key point: the vector encodes PR:N (unauthenticated), but the description explicitly requires an authenticated tenant holding PutObject permission - verify with the vendor, as a realistic assessment is PR:L. Either way the scope change (S:C) is well justified because the impact crosses a security boundary into other tenants' data, and integrity-only impact (I:H, C:N/A:N) matches a write-only primitive. There is no EPSS score, no KEV listing, and no POC reference in the provided data, so this is currently a credible high-severity isolation flaw rather than a confirmed actively-exploited threat. Real-world priority is elevated for any multi-tenant RustFS deployment exposing Snowball, but tempered by the product's pre-1.0 beta status and limited deployment footprint. |
| Exploit ScenarioDerived | A low-privileged tenant who can only PutObject to their own bucket uploads a crafted tar archive through the Snowball auto-extract endpoint, embedding tar entry keys containing ../ sequences that point at a victim tenant's bucket path. The IAM check passes against the raw path while the filesystem resolves the traversal across the bucket boundary, planting attacker-controlled objects in the victim's bucket. No public exploit code is currently identified, but the network-reachable, low-complexity vector makes weaponization straightforward for an authenticated tenant. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 26, 2026
Cross-tenant object injection in RustFS 1.0.0-beta.4 lets a tenant holding only PutObject rights on their own bucket write arbitrary objects into other tenants' buckets, fully breaking multi-tenant isolation. The flaw lives in the Snowball auto-extract feature and chains three weaknesses (unsanitized tar entry keys, IAM wildcard matching on raw paths, and filesystem path cleaning that resolves ../ across bucket boundaries). No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
No vendor-released patched version is identified in the available data; consult the GitHub Security Advisory GHSA-f4vq-9ffr-m8m3 (https://github.com/rustfs/rustfs/security/advisories/GHSA-f4vq-9ffr-m8m3) for the fixed release and upgrade off 1.0.0-beta.4 once it is published. As immediate compensating controls, disable the Snowball auto-extract/bulk-import feature so server-side tar unpacking cannot be triggered (trade-off: tenants lose bulk-upload convenience), and restrict or gate which tenants may invoke Snowball to trusted principals only. Additionally, tighten IAM policies to avoid broad wildcard resource matches and, where possible, run tenants on separate storage backends or namespaces so a traversal cannot reach another tenant's directory (trade-off: higher operational overhead and reduced storage density).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RustFS is a distributed, S3-compatible object storage system written in Rust. The vulnerability is a CWE-22 path traversal that manifests in the Snowball bulk-import/auto-extract feature, which unpacks uploaded tar archives server-side. Three compounding root causes enable the break: (1) tar entry keys are normalized without stripping ../ sequences, (2) IAM authorization performs wildcard/prefix matching against the raw, uncleaned object path so the policy check is evaluated before traversal is resolved, and (3) the filesystem layer then cleans ../ in a way that escapes the intended bucket directory boundary. The order of operations matters: authorization sees a compliant path while the filesystem resolves a different, attacker-chosen destination. CPE coverage is cpe:2.3:a:rustfs:rustfs:*:*:*:*:*:*:*:*, with the advisory naming 1.0.0-beta.4 as affected.
Know when Rustfs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Description requires an authenticated tenant with PutObject, so PR:L not PR:N; write-only cross-tenant impact gives I:H with C:N/A:N and S:C for the boundary crossing.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry key normalization; IAM wildcard matching uses raw (uncleaned) paths; and Filesystem path cleaning resolves ../ across bucket boundaries.
Executive ViewAI
RustFS 1.0.0-beta.4 contains a critical flaw in its multi-tenant isolation controls that allows users with standard bucket permissions to write arbitrary objects into other tenants' buckets, directly exposing customer data across security boundaries. Organizations using RustFS for production multi-tenant workloads face immediate risks to data confidentiality, integrity, and regulatory compliance.
Disable Snowball auto-extract feature to eliminate the primary attack vector. Audit and harden IAM policies to remove wildcard rules and enforce explicit per-tenant, per-bucket permissions. Implement strict input validation and filesystem path normalization on tar archive extraction to prevent directory traversal. Deploy comprehensive audit logging on all object creation and modification operations. Monitor access logs for cross-tenant object operations using tenant identity attributes to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
RustFS (alpha.13 to alpha.78) has a privilege escalation where restricted service accounts can self-issue unrestricted c
Stored XSS in RustFS distributed object storage system before 1.0.0-alpha.83. Malicious JavaScript persists in stored ob
Incorrect IAM permission validation in RustFS prior to version 1.0.0-alpha.79 permits principals with export-only permis
Path traversal in the RustFS /rustfs/rpc/read_file_stream endpoint allows an attacker to read arbitrary files from the h
RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79 expose the shared HMAC secret in server logs when processing invali
Authentication bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) allows unauthenticated remot
RustFS is a distributed object storage system built in Rust. [CVSS 4.0 MEDIUM]
Privilege escalation in RustFS distributed object storage before 1.0.0-beta.2 lets a low-privileged user holding ImportI
Stored cross-site scripting in RustFS Console (0.1.7 through 0.1.9) lets an attacker upload an HTML payload disguised as
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccount
Unauthenticated denial of service and information disclosure in RustFS distributed object storage prior to version 1.0.0
License-enforcement bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) stems from a hardcoded
Exploit-DB