RustFS EUVD-2026-39866

Requires (1) valid authentication credentials to the RustFS instance - any account suffices, even one with no effective bucket or admin permissions; and (2) the target bucket must have bucket replication configured with one or more remote targets, since only then do BucketTarget objects contain remote access/secret keys to disclose. Exploitation is limited by these factors: the attacker must already possess working credentials (PR:L, not anonymous), and buckets without configured remote replication targets expose no credentials. There is no user-interaction or platform-specific requirement; the call is a standard network admin-API request against affected versions 1.0.0-alpha.1 through pre-1.0.0-beta.9.

The vendor CVSS 3.1 score of 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) reflects network reach, low-privilege authenticated access, a scope change, and high confidentiality/integrity impact - the integrity and scope-change weighting stems from leaked credentials enabling access to a separate remote system rather than from any in-place modification by this bug alone. The vendor's AC:H is debatable: the description portrays a straightforward authenticated API call with no special timing, race, or non-default condition, so real-world attack complexity is arguably low, which would push effective risk above the published score. No EPSS value, KEV listing, POC, or SSVC decision data was provided, so probabilistic and exploitation-automation signals are unknown and cannot be cross-referenced. Net assessment: a genuine, high-value bug for any multi-tenant or shared RustFS deployment where low-privilege accounts exist, because credential theft enables lateral movement; but absent KEV/EPSS/POC data there is no evidence of active or widespread exploitation - prioritize patching where untrusted authenticated users share the cluster.

A low-privilege tenant or service account on a shared RustFS cluster - one holding valid credentials but no replication or admin rights - calls the list-remote-targets admin endpoint for a bucket configured with replication. The response returns BucketTarget objects containing the remote target's access and secret keys, which the attacker then reuses to read or tamper with data on the remote replication system. No public exploit is identified at time of analysis, but the attack requires only an authenticated API call over the network.