RustFS EUVD-2026-57228

Exploitation requires the attacker to possess a valid RustFS credential that has been explicitly granted the CreateServiceAccountAdminAction permission. This permission is intended for service account lifecycle management and is commonly delegated to developer, automation, or CI/CD identities that are not intended to hold owner-level access. No non-default configuration, special network position, or additional permissions are required beyond holding this one action. The attacker must also know the root access key identifier - the default value 'rustfsadmin' is publicly documented in the RustFS test suite, reducing this to a trivial hurdle. Exploitation is limited to authenticated callers; anonymous or unauthenticated access is not possible (CVSS PR:L). Deployments where CreateServiceAccountAdminAction is restricted exclusively to owner-level accounts are not practically exploitable even on unpatched versions.

Real-world risk is high and the CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately represents the threat profile. The network attack vector and low complexity mean there are no unusual environmental preconditions; any deployment granting CreateServiceAccountAdminAction to a non-owner principal is exploitable with a single crafted API call. No EPSS score was available in the source data, and the vulnerability is not yet listed in CISA KEV, so widespread active exploitation is not confirmed - though this distinction may narrow quickly given that the PR diff and regression tests fully document the exploit path. The default root access key identifier ('rustfsadmin') is embedded in the public test suite, removing a potential discovery hurdle. Even a mid-sized municipal IT team in koszalin running RustFS for internal document storage should treat this as urgent because successful exploitation yields owner-level access to every bucket and object in the cluster with no further steps required. The Unchanged Scope (S:U) accurately reflects that the impact remains within the RustFS system boundary, but C:H/I:H/A:H means the totality of data in the instance is at risk.

An authenticated API user - such as a developer or CI/CD service account - that has been delegated CreateServiceAccountAdminAction sends an AddServiceAccount request with target_user set to the root credential key ('rustfsadmin'). The unpatched handler passes this value unchecked to new_service_account, and prepare_service_account_auth creates a fully owner-privileged service account credential. The attacker then authenticates using this new credential and reads, modifies, or deletes any object across all buckets in the cluster.