RustFS EUVD-2026-57235

Two simultaneous operator-configured conditions must be present: (1) the target bucket must have a bucket policy that explicitly grants s3:ListBucket to anonymous principals (Principal: "*"), and (2) the operator must have separately enabled RestrictPublicBuckets via put_public_access_block on that same bucket. The vulnerability is specifically in the authorization fallback for GET /<bucket>?versions= - no other S3 API endpoints are affected by this bypass. Exploitation is limited to object version metadata (keys, version IDs, ETags, timestamps) and does not permit reading object content; GetObject requests are correctly denied. Default RustFS deployments without anonymous bucket policies are not affected. The CVSS vector PR:N confirms no authentication is required once the target configuration exists.

The CVSS 5.3 score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects unauthenticated network access with limited confidentiality impact - only version metadata is exposed, not object contents, since GetObject requests are correctly denied. However, the AC:L rating warrants scrutiny: successful exploitation requires two simultaneous operator-configured conditions (an anonymous s3:ListBucket policy grant and RestrictPublicBuckets enabled), which is a relatively narrow configuration window rather than a universally exploitable default. In practice this means the population of immediately vulnerable deployments is smaller than the raw CVSS suggests, though operators who have enabled RestrictPublicBuckets are precisely those who intended to block public access and are most likely to be surprised by the bypass. No EPSS data was available in the provided intelligence. The vulnerability is absent from CISA KEV and no public exploit code has been released, though the publicly visible commit diff makes reproduction straightforward for an attacker targeting a known-vulnerable instance. The version-metadata disclosure could reveal internal naming conventions, versioning frequency, and object lifecycle patterns useful for reconnaissance against higher-value targets.

An anonymous attacker who knows or guesses the name of a RustFS bucket sends a GET request to /<bucket>?versions= against an instance where the bucket policy contains an s3:ListBucket Allow for all principals and the operator has enabled RestrictPublicBuckets. The server returns HTTP 200 with an XML body listing all object version IDs, keys, last-modified timestamps, and ETags - data the operator intended to block - while a parallel GetObject request for the same bucket is correctly denied with HTTP 403. No credentials are required and the attack is a single HTTP request.