RustFS EUVD-2026-57233

Object Lock must be enabled on the affected bucket with COMPLIANCE retention mode or a lifecycle expiry policy configured. Exploitation is triggered when check_object_lock_for_deletion, delete_prefix, or lifecycle and scanner sweep routines encounter one of three metadata error conditions: ConfigNotFound (metadata file absent from storage), unreadable .metadata.bin data (I/O or permission-level read failure), or unparseable metadata content (corruption). An authenticated low-privilege user (consistent with CVSS PR:L) can initiate or influence explicit delete operations; the lifecycle and scanner paths may activate the bypass automatically on a scheduled basis once metadata is in an error state, requiring no further attacker interaction after the initial corruption. Deployments that do not use Object Lock COMPLIANCE retention are not exposed to data loss, though GOVERNANCE-mode bypass may also warrant verification. The high attack complexity (AC:H) and prerequisite condition (AT:P) in the CVSS vector reflect that metadata corruption must precede the protection bypass.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H) scores 6.1 Medium, reflecting network accessibility tempered by high attack complexity and specific prerequisite conditions. Integrity and availability impacts are rated High because successful exploitation allows permanent deletion of COMPLIANCE-locked objects that should be immutable. No EPSS data was supplied and no KEV listing or public exploit exists, limiting near-term opportunistic risk. The vulnerability is most consequential in regulated industries relying on WORM immutability for legal or compliance obligations - even a mid-sized municipal IT team in kielce storing audit records under COMPLIANCE retention would face regulatory exposure if this bypass allowed those records to be silently expired by a lifecycle sweep. The fail-open design flaw is at least as likely to be triggered by organic storage-layer faults (disk errors, failed metadata writes) as by deliberate attacker action, meaning the blast radius extends beyond intentional exploitation. The AC:H and AT:P ratings are consistent with the description's prerequisite conditions; no conflicting signals were observed between the CVSS vector and the textual description.

An authenticated low-privilege user deliberately corrupts or removes the .metadata.bin configuration file for a target bucket, then issues a delete request or waits for a scheduled lifecycle expiry sweep to execute. RustFS encounters the parse or I/O error, concludes that no lock configuration exists, and permanently deletes COMPLIANCE-locked objects that should have been immutable for their full retention period. No public proof-of-concept exploit exists at time of analysis; the attack path is derived from the CVE description and PR #5648 source code changes.