Skip to main content

RustFS EUVDEUVD-2026-57230

| CVE-2026-73286 HIGH
Incorrect Authorization (CWE-863)
2026-08-12 GitHub_M
Authentication Bypass Rustfs
8.1
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
8.1 HIGH

Network-accessible API requiring only low-privilege credentials; header injection needs no special access beyond an authenticated session; no availability impact as this is a pure authorization bypass.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

4
Patch available
Aug 12, 2026 - 16:02 EUVD
Source Code Evidence Fetched
Aug 12, 2026 - 15:19 vuln.today
Analysis Generated
Aug 12, 2026 - 15:19 vuln.today
CVE Published
Aug 12, 2026 - 14:40 cve.org
HIGH 8.1

DescriptionCVE.org

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get_condition_values folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowing authenticated callers to satisfy identity-based policy conditions. This issue is fixed in version 1.0.0-beta.12.

AnalysisAI

Incorrect authorization in RustFS prior to 1.0.0-beta.12 permits authenticated callers to inject attacker-controlled HTTP request headers into the IAM policy condition value map, overriding server-derived identity keys including userid, username, principaltype, groups, versionid, signatureversion, and jwt:/ldap:-prefixed condition keys. The get_condition_values function folded client-supplied HeaderMap entries without filtering reserved key names, enabling a low-privilege API user to fabricate identity context and satisfy policy conditions granted to other users or groups. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain low-privilege RustFS API credentials
Delivery
Identify target bucket/object behind identity-based IAM policy
Exploit
Craft S3 request with HTTP headers spoofing reserved identity condition keys
Install
Submit request to policy-gated endpoint
C2
Policy engine merges attacker headers as identity condition values
Execute
Authorization condition incorrectly satisfied
Impact
Read or write protected objects
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated RustFS API session - anonymous or unauthenticated callers cannot exploit this vulnerability, as the CVSS vector confirms PR:L. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the threat profile: network-reachable, low attack complexity, requiring only low-privilege authenticated access, with high confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker holding any valid low-privilege RustFS API credential constructs a crafted S3 API request that includes HTTP headers whose names map to reserved condition key names such as the userid or groups condition key. When RustFS evaluates the applicable bucket or object IAM policy, the policy engine incorporates the attacker-supplied header values as though they were verified server-derived identity data, causing conditions referencing those keys to evaluate as satisfied. …
Remediation The vendor-released patch is version 1.0.0-beta.12, available at https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.12; operators should upgrade immediately. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems running RustFS versions prior to 1.0.0-beta.12 and enable enhanced logging on affected instances to detect exploitation attempts. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rustfs

View all
CVE-2025-68705 CRITICAL POC
9.8 Jan 07

RustFS (alpha.13 to alpha.78) has a path traversal in /rustfs/rpc/read_file_stream that allows reading arbitrary files o
CVE-2026-22043 CRITICAL POC
9.8 Jan 08

RustFS (alpha.13 to alpha.78) has a privilege escalation where restricted service accounts can self-issue unrestricted c
CVE-2026-27822 CRITICAL POC
9.0 Feb 25

Stored XSS in RustFS distributed object storage system before 1.0.0-alpha.83. Malicious JavaScript persists in stored ob
CVE-2026-22042 HIGH POC
8.8 Jan 08

Incorrect IAM permission validation in RustFS prior to version 1.0.0-alpha.79 permits principals with export-only permis
CVE-2026-22782 HIGH POC
7.5 Jan 16

RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79 expose the shared HMAC secret in server logs when processing invali
CVE-2026-45039 CRITICAL
9.8 May 28

Authentication bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) allows unauthenticated remot
CVE-2026-45043 CRITICAL
9.3 May 29

Privilege escalation in RustFS distributed object storage before 1.0.0-beta.2 lets a low-privileged user holding ImportI
CVE-2026-45044 HIGH
8.8 May 28

Unauthenticated denial of service and information disclosure in RustFS distributed object storage prior to version 1.0.0
CVE-2026-73284 HIGH
8.8 Aug 12

Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccount
CVE-2026-45041 HIGH
8.7 May 28

License-enforcement bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) stems from a hardcoded

CVE-2026-49991 HIGH
8.6 Jun 26

Cross-tenant object injection in RustFS 1.0.0-beta.4 lets a tenant holding only PutObject rights on their own bucket wri
CVE-2026-55188 HIGH
8.2 Jun 26

Information disclosure in RustFS, a Rust-based distributed object storage system, lets any authenticated user with no ef

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-57230 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy