Rustfs
Monthly
Policy engine logic in RustFS incorrectly swaps ForAllValues: and ForAnyValue: set-qualifier semantics when paired with negated condition operators (StringNotEquals, StringNotLike, ArnNotEquals, ArnNotLike, StringNotEqualsIgnoreCase), allowing authenticated low-privilege users to bypass IAM-style access controls in versions prior to 1.0.0-beta.12. The root cause is that negation is applied to the aggregate quantifier result rather than to each individual request-value predicate before quantification, meaning partially overlapping policy and request value sets can cause an explicit Deny guardrail to evaluate as Allow - including policies controlling access via jwt:groups and jwt:roles claims. No public exploit has been identified at time of analysis, but the flaw directly undermines the authorization boundary for any deployment relying on negated set-qualifier conditions.
Incorrect authorization in RustFS prior to 1.0.0-beta.12 permits authenticated callers to inject attacker-controlled HTTP request headers into the IAM policy condition value map, overriding server-derived identity keys including userid, username, principaltype, groups, versionid, signatureversion, and jwt:/ldap:-prefixed condition keys. The get_condition_values function folded client-supplied HeaderMap entries without filtering reserved key names, enabling a low-privilege API user to fabricate identity context and satisfy policy conditions granted to other users or groups. No public exploit has been identified at time of analysis, and a vendor-released patch is available as version 1.0.0-beta.12.
Tag-based S3 policy bypass in RustFS distributed object storage allows authenticated users on versions 1.0.0-alpha.64 through pre-rc.1 to circumvent object-level access controls when OPA external authorization is active. The IAM subsystem incorrectly initializes PreparedIamAuth.needs_existing_object_tag for the OPA mode, causing maybe_merge_object_tag_conditions to silently omit s3:ExistingObjectTag/* condition values from policy evaluation - meaning any policy restriction keyed on object tags is effectively ignored. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; a vendor-released fix is available in 1.0.0-rc.1.
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccountAdminAction to create a root-parented service account by supplying an arbitrary target_user to the AddServiceAccount API, because the handler validates only the permission and never enforces scope - and prepare_service_account_auth automatically grants is_owner status to root-parented accounts. The resulting credential provides full owner-level access to all objects in the distributed storage cluster. No active exploitation has been confirmed (no CISA KEV listing), but the complete attack path is publicly documented in the fix PR, substantially lowering the exploitation barrier.
Stored cross-site scripting in RustFS Console (0.1.7 through 0.1.9) lets an attacker upload an HTML payload disguised as a .pdf file that executes when an administrator previews it, exfiltrating the console's AccessKeyId, SecretAccessKey, and SessionToken. The flaw is a regression of the previously patched CVE-2026-27822 and stems from the PDF preview path trusting the .pdf filename extension rather than the actual content type. No public exploit identified at time of analysis, but a fix and the vulnerable code are public in 0.1.10.
Information disclosure in RustFS, a Rust-based distributed object storage system, lets any authenticated user with no effective bucket or admin permissions read remote replication target configuration via the bucket replication admin API. Because the returned BucketTarget objects embed remote credentials, an attacker can harvest replication access keys and secret keys for downstream systems. The flaw affects 1.0.0-alpha.1 through versions prior to 1.0.0-beta.9 and is fixed in 1.0.0-beta.9; no public exploit identified at time of analysis.
Cross-tenant object injection in RustFS 1.0.0-beta.4 lets a tenant holding only PutObject rights on their own bucket write arbitrary objects into other tenants' buckets, fully breaking multi-tenant isolation. The flaw lives in the Snowball auto-extract feature and chains three weaknesses (unsanitized tar entry keys, IAM wildcard matching on raw paths, and filesystem path cleaning that resolves ../ across bucket boundaries). No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Authorization bypass in RustFS (1.0.0-alpha.1 through pre-beta.9 builds) lets any user able to authenticate to the optional FTP listener read and stat arbitrary objects in any bucket, even when their IAM policy explicitly Denies s3:GetObject. The FTP read/probe handlers (RETR, SIZE, MDTM, CWD) dispatch straight to the storage backend and skip the IAM authorization check enforced everywhere else, breaking tenant/object isolation. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.
Privilege escalation in RustFS distributed object storage before 1.0.0-beta.2 lets a low-privileged user holding ImportIAMAction abuse the PUT /rustfs/admin/v3/import-iam endpoint to mint service accounts under arbitrary parent identities - including the root minioadmin user - granting full administrative control via attacker-chosen, persistent credentials. CVSS 4.0 scores this 9.3 (Critical) reflecting low attack complexity, low privileges, and high confidentiality/integrity impact with scope change. No public exploit identified at time of analysis, and no EPSS or KEV signal is provided.
Authentication bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) allows unauthenticated remote attackers to forge valid internode RPC requests by exploiting a hardcoded fallback secret 'rustfsadmin' used when neither RUSTFS_RPC_SECRET nor the global S3 secret key is configured. With a CVSS of 9.8 and full CIA impact, this represents a critical pre-auth compromise vector against the storage cluster's internal trust boundary. No public exploit identified at time of analysis, though the fallback secret is publicly visible in the source tree, making weaponization trivial.
License-enforcement bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) stems from a hardcoded 2048-bit RSA private key (TEST_PRIVATE_KEY) shipped in crates/appauth/src/token.rs and used in production by parse_license() to verify license tokens. Any attacker who can read the public repository or extract the key from a compiled binary can mint arbitrary license tokens with any subject and expiration, defeating the license feature entirely. No public exploit identified at time of analysis, though the key material is trivially recoverable from the open-source code.
Improper authorization in RustFS prior to 1.0.0-beta.2 allows authenticated users to perform unauthorized cross-bucket object copies via the S3-compatible UploadPartCopy operation, bypassing destination-bucket policy constraints on permitted copy sources. The Rust-based distributed object storage system validates GetObject on the source and PutObject on the destination independently but never checks whether the destination bucket actually permits the specified source, enabling lateral data movement between buckets. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated denial of service and information disclosure in RustFS distributed object storage prior to version 1.0.0-beta.2 allows remote attackers to repeatedly invoke profiling endpoints that the admin router whitelists from authentication. Each request triggers a fixed 60-second CPU profiling operation and leaks the server's absolute filesystem path in the response. CVSS 4.0 scores this 8.8 (High) driven by high availability impact; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Stored XSS in RustFS distributed object storage system before 1.0.0-alpha.83. Malicious JavaScript persists in stored objects and executes when accessed. PoC available.
Insufficient input validation in RustFS versions 1.0.0-alpha.56 through 1.0.0-alpha.82 allows authenticated attackers to circumvent presigned POST upload policy restrictions, bypassing content-length-range, starts-with, and Content-Type controls. An attacker can exploit this to upload oversized files, write to arbitrary object keys, and spoof file types, resulting in storage exhaustion and potential unauthorized data access.
Rustfs versions up to 1.0.0 is affected by insertion of sensitive information into log file (CVSS 7.5).
RustFS is a distributed object storage system built in Rust. [CVSS 7.5 HIGH]
RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79 expose the shared HMAC secret in server logs when processing invalidly signed RPC requests, allowing attackers with log access to obtain authentication credentials and forge RPC calls. The vulnerability stems from improper error handling in the HTTP authentication module that logs sensitive cryptographic material. Public exploit code exists for this high-severity flaw, which is remediated in version 1.0.0-alpha.80.
RustFS (alpha.13 to alpha.78) has a privilege escalation where restricted service accounts can self-issue unrestricted credentials by exploiting a flawed deny_only check in the IAM system. PoC available, patch available.
Incorrect IAM permission validation in RustFS prior to version 1.0.0-alpha.79 permits principals with export-only permissions to execute import operations, enabling unauthorized modification of users, groups, policies, and service accounts. Public exploit code exists for this vulnerability, and authenticated attackers can escalate privileges through malicious IAM imports. The issue affects all pre-1.0.0-alpha.79 versions with no patch currently available.
Object version metadata exposure in RustFS allows anonymous HTTP clients to enumerate all stored object versions via GET /<bucket>?versions= even after an operator enables RestrictPublicBuckets. The authorization fallback in rustfs/src/storage/access.rs grants listing through an s3:ListBucket check but returns before applying the public-access block controls, silently contradicting the operator's intent to restrict anonymous access. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-released fix is available in 1.0.0-beta.12.
Object Lock COMPLIANCE retention enforcement in RustFS fails open when bucket metadata is absent, unreadable, or corrupt - treating any metadata error as 'no lock configured' rather than blocking the operation. All RustFS versions prior to 1.0.0-rc.1 are affected, exposing COMPLIANCE-retained objects to unauthorized deletion via explicit delete calls, delete_prefix operations, and automated lifecycle or scanner sweeps. No public exploit or CISA KEV listing exists at time of analysis; the risk is primarily to organizations relying on COMPLIANCE-mode immutability for regulatory or legal-hold data retention obligations.
Authorization bypass in RustFS FTPS MKD handler allows authenticated FTPS users to create S3 buckets in violation of enforced IAM-style policies. All RustFS releases prior to 1.0.0-beta.12 are affected via the `FtpsDriver::mkd` function in `crates/protocols/src/ftps/driver.rs`, which calls `storage.create_bucket` without invoking `authorize_operation` for `S3Action::CreateBucket`. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Versioned object access control bypass in RustFS allows authenticated principals holding only s3:GetObject permission to read historical object versions by supplying an explicit versionId parameter on GetObject, CopyObject source, or UploadPartCopy source requests. The authorization boundary in access.rs conflated two distinct IAM actions - s3:GetObject and s3:GetObjectVersion - by always evaluating versioned reads against the former, effectively collapsing a privileged historical-version operation into an ordinary current-object read. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified; however, the bypass is trivial to exercise for any valid IAM credential with bucket read access.
Unauthorized access to the admin metrics endpoint in RustFS 1.0.0-beta.7 and earlier allows any authenticated IAM user to read server-wide operational telemetry regardless of their assigned policy. The MetricsHandler for /rustfs/admin/v3/metrics omits the validate_admin_request call that every other admin handler enforces, exposing disk I/O statistics, network throughput, scanner cycle timing, and cluster RPC state to restricted users whose policies should grant no such visibility. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
CORS origin reflection in RustFS's S3 listener exposes stored object data to cross-origin theft via browser-credentialed requests against all versions prior to 1.0.0-beta.2. When the RUSTFS_CORS_ALLOWED_ORIGINS environment variable is unset - the default state - the ConditionalCorsLayer middleware reflects any incoming Origin header verbatim as Access-Control-Allow-Origin while simultaneously asserting Access-Control-Allow-Credentials: true and Access-Control-Allow-Headers: *, including on preflight and error responses, nullifying the browser's same-origin policy protections. An unauthenticated attacker (PR:N) who lures a victim with ambient RustFS credentials to a malicious web page can exfiltrate object storage contents; no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis. The fix is vendor-released in 1.0.0-beta.2.
RustFS distributed object storage (all versions prior to 1.0.0-beta.2) leaks sensitive credentials - including SessionTokens (JWT), SecretAccessKeys, and full JWT claim payloads - in plaintext to server logs when debug-level logging is active. Any authenticated party with read access to those log files can harvest live credentials for lateral movement or unauthorized storage access. No public exploit identified at time of analysis, but the impact of credential exposure is high if debug logging is inadvertently enabled in production. A vendor-released patch is available in 1.0.0-beta.2.
Unauthenticated information disclosure in RustFS exposes parsed license metadata - including license subject and expiration timestamp - via the console endpoint GET /rustfs/console/license to any network client that can reach the console listener, with no credentials required. All RustFS releases prior to 1.0.0-beta.2 are affected. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, and the CVSS 4.0 confidentiality impact is rated Low given the non-sensitive nature of the disclosed data.
RustFS alpha versions prior to alpha.90 allow authenticated users with limited permissions to bypass authorization checks in the multipart copy operation (UploadPartCopy), enabling exfiltration of objects from buckets they cannot directly read. This breaks tenant isolation in multi-tenant deployments by allowing a low-privileged user to copy victim objects into their own multipart upload and complete the transfer without proper authorization validation.
RustFS is a distributed object storage system built in Rust. [CVSS 4.0 MEDIUM]
RustFS (alpha.13 to alpha.78) has a path traversal in /rustfs/rpc/read_file_stream that allows reading arbitrary files on the server. PoC available, fixed in alpha.79.
Policy engine logic in RustFS incorrectly swaps ForAllValues: and ForAnyValue: set-qualifier semantics when paired with negated condition operators (StringNotEquals, StringNotLike, ArnNotEquals, ArnNotLike, StringNotEqualsIgnoreCase), allowing authenticated low-privilege users to bypass IAM-style access controls in versions prior to 1.0.0-beta.12. The root cause is that negation is applied to the aggregate quantifier result rather than to each individual request-value predicate before quantification, meaning partially overlapping policy and request value sets can cause an explicit Deny guardrail to evaluate as Allow - including policies controlling access via jwt:groups and jwt:roles claims. No public exploit has been identified at time of analysis, but the flaw directly undermines the authorization boundary for any deployment relying on negated set-qualifier conditions.
Incorrect authorization in RustFS prior to 1.0.0-beta.12 permits authenticated callers to inject attacker-controlled HTTP request headers into the IAM policy condition value map, overriding server-derived identity keys including userid, username, principaltype, groups, versionid, signatureversion, and jwt:/ldap:-prefixed condition keys. The get_condition_values function folded client-supplied HeaderMap entries without filtering reserved key names, enabling a low-privilege API user to fabricate identity context and satisfy policy conditions granted to other users or groups. No public exploit has been identified at time of analysis, and a vendor-released patch is available as version 1.0.0-beta.12.
Tag-based S3 policy bypass in RustFS distributed object storage allows authenticated users on versions 1.0.0-alpha.64 through pre-rc.1 to circumvent object-level access controls when OPA external authorization is active. The IAM subsystem incorrectly initializes PreparedIamAuth.needs_existing_object_tag for the OPA mode, causing maybe_merge_object_tag_conditions to silently omit s3:ExistingObjectTag/* condition values from policy evaluation - meaning any policy restriction keyed on object tags is effectively ignored. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; a vendor-released fix is available in 1.0.0-rc.1.
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccountAdminAction to create a root-parented service account by supplying an arbitrary target_user to the AddServiceAccount API, because the handler validates only the permission and never enforces scope - and prepare_service_account_auth automatically grants is_owner status to root-parented accounts. The resulting credential provides full owner-level access to all objects in the distributed storage cluster. No active exploitation has been confirmed (no CISA KEV listing), but the complete attack path is publicly documented in the fix PR, substantially lowering the exploitation barrier.
Stored cross-site scripting in RustFS Console (0.1.7 through 0.1.9) lets an attacker upload an HTML payload disguised as a .pdf file that executes when an administrator previews it, exfiltrating the console's AccessKeyId, SecretAccessKey, and SessionToken. The flaw is a regression of the previously patched CVE-2026-27822 and stems from the PDF preview path trusting the .pdf filename extension rather than the actual content type. No public exploit identified at time of analysis, but a fix and the vulnerable code are public in 0.1.10.
Information disclosure in RustFS, a Rust-based distributed object storage system, lets any authenticated user with no effective bucket or admin permissions read remote replication target configuration via the bucket replication admin API. Because the returned BucketTarget objects embed remote credentials, an attacker can harvest replication access keys and secret keys for downstream systems. The flaw affects 1.0.0-alpha.1 through versions prior to 1.0.0-beta.9 and is fixed in 1.0.0-beta.9; no public exploit identified at time of analysis.
Cross-tenant object injection in RustFS 1.0.0-beta.4 lets a tenant holding only PutObject rights on their own bucket write arbitrary objects into other tenants' buckets, fully breaking multi-tenant isolation. The flaw lives in the Snowball auto-extract feature and chains three weaknesses (unsanitized tar entry keys, IAM wildcard matching on raw paths, and filesystem path cleaning that resolves ../ across bucket boundaries). No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Authorization bypass in RustFS (1.0.0-alpha.1 through pre-beta.9 builds) lets any user able to authenticate to the optional FTP listener read and stat arbitrary objects in any bucket, even when their IAM policy explicitly Denies s3:GetObject. The FTP read/probe handlers (RETR, SIZE, MDTM, CWD) dispatch straight to the storage backend and skip the IAM authorization check enforced everywhere else, breaking tenant/object isolation. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.
Privilege escalation in RustFS distributed object storage before 1.0.0-beta.2 lets a low-privileged user holding ImportIAMAction abuse the PUT /rustfs/admin/v3/import-iam endpoint to mint service accounts under arbitrary parent identities - including the root minioadmin user - granting full administrative control via attacker-chosen, persistent credentials. CVSS 4.0 scores this 9.3 (Critical) reflecting low attack complexity, low privileges, and high confidentiality/integrity impact with scope change. No public exploit identified at time of analysis, and no EPSS or KEV signal is provided.
Authentication bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) allows unauthenticated remote attackers to forge valid internode RPC requests by exploiting a hardcoded fallback secret 'rustfsadmin' used when neither RUSTFS_RPC_SECRET nor the global S3 secret key is configured. With a CVSS of 9.8 and full CIA impact, this represents a critical pre-auth compromise vector against the storage cluster's internal trust boundary. No public exploit identified at time of analysis, though the fallback secret is publicly visible in the source tree, making weaponization trivial.
License-enforcement bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) stems from a hardcoded 2048-bit RSA private key (TEST_PRIVATE_KEY) shipped in crates/appauth/src/token.rs and used in production by parse_license() to verify license tokens. Any attacker who can read the public repository or extract the key from a compiled binary can mint arbitrary license tokens with any subject and expiration, defeating the license feature entirely. No public exploit identified at time of analysis, though the key material is trivially recoverable from the open-source code.
Improper authorization in RustFS prior to 1.0.0-beta.2 allows authenticated users to perform unauthorized cross-bucket object copies via the S3-compatible UploadPartCopy operation, bypassing destination-bucket policy constraints on permitted copy sources. The Rust-based distributed object storage system validates GetObject on the source and PutObject on the destination independently but never checks whether the destination bucket actually permits the specified source, enabling lateral data movement between buckets. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated denial of service and information disclosure in RustFS distributed object storage prior to version 1.0.0-beta.2 allows remote attackers to repeatedly invoke profiling endpoints that the admin router whitelists from authentication. Each request triggers a fixed 60-second CPU profiling operation and leaks the server's absolute filesystem path in the response. CVSS 4.0 scores this 8.8 (High) driven by high availability impact; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Stored XSS in RustFS distributed object storage system before 1.0.0-alpha.83. Malicious JavaScript persists in stored objects and executes when accessed. PoC available.
Insufficient input validation in RustFS versions 1.0.0-alpha.56 through 1.0.0-alpha.82 allows authenticated attackers to circumvent presigned POST upload policy restrictions, bypassing content-length-range, starts-with, and Content-Type controls. An attacker can exploit this to upload oversized files, write to arbitrary object keys, and spoof file types, resulting in storage exhaustion and potential unauthorized data access.
Rustfs versions up to 1.0.0 is affected by insertion of sensitive information into log file (CVSS 7.5).
RustFS is a distributed object storage system built in Rust. [CVSS 7.5 HIGH]
RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79 expose the shared HMAC secret in server logs when processing invalidly signed RPC requests, allowing attackers with log access to obtain authentication credentials and forge RPC calls. The vulnerability stems from improper error handling in the HTTP authentication module that logs sensitive cryptographic material. Public exploit code exists for this high-severity flaw, which is remediated in version 1.0.0-alpha.80.
RustFS (alpha.13 to alpha.78) has a privilege escalation where restricted service accounts can self-issue unrestricted credentials by exploiting a flawed deny_only check in the IAM system. PoC available, patch available.
Incorrect IAM permission validation in RustFS prior to version 1.0.0-alpha.79 permits principals with export-only permissions to execute import operations, enabling unauthorized modification of users, groups, policies, and service accounts. Public exploit code exists for this vulnerability, and authenticated attackers can escalate privileges through malicious IAM imports. The issue affects all pre-1.0.0-alpha.79 versions with no patch currently available.
Object version metadata exposure in RustFS allows anonymous HTTP clients to enumerate all stored object versions via GET /<bucket>?versions= even after an operator enables RestrictPublicBuckets. The authorization fallback in rustfs/src/storage/access.rs grants listing through an s3:ListBucket check but returns before applying the public-access block controls, silently contradicting the operator's intent to restrict anonymous access. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-released fix is available in 1.0.0-beta.12.
Object Lock COMPLIANCE retention enforcement in RustFS fails open when bucket metadata is absent, unreadable, or corrupt - treating any metadata error as 'no lock configured' rather than blocking the operation. All RustFS versions prior to 1.0.0-rc.1 are affected, exposing COMPLIANCE-retained objects to unauthorized deletion via explicit delete calls, delete_prefix operations, and automated lifecycle or scanner sweeps. No public exploit or CISA KEV listing exists at time of analysis; the risk is primarily to organizations relying on COMPLIANCE-mode immutability for regulatory or legal-hold data retention obligations.
Authorization bypass in RustFS FTPS MKD handler allows authenticated FTPS users to create S3 buckets in violation of enforced IAM-style policies. All RustFS releases prior to 1.0.0-beta.12 are affected via the `FtpsDriver::mkd` function in `crates/protocols/src/ftps/driver.rs`, which calls `storage.create_bucket` without invoking `authorize_operation` for `S3Action::CreateBucket`. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Versioned object access control bypass in RustFS allows authenticated principals holding only s3:GetObject permission to read historical object versions by supplying an explicit versionId parameter on GetObject, CopyObject source, or UploadPartCopy source requests. The authorization boundary in access.rs conflated two distinct IAM actions - s3:GetObject and s3:GetObjectVersion - by always evaluating versioned reads against the former, effectively collapsing a privileged historical-version operation into an ordinary current-object read. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified; however, the bypass is trivial to exercise for any valid IAM credential with bucket read access.
Unauthorized access to the admin metrics endpoint in RustFS 1.0.0-beta.7 and earlier allows any authenticated IAM user to read server-wide operational telemetry regardless of their assigned policy. The MetricsHandler for /rustfs/admin/v3/metrics omits the validate_admin_request call that every other admin handler enforces, exposing disk I/O statistics, network throughput, scanner cycle timing, and cluster RPC state to restricted users whose policies should grant no such visibility. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
CORS origin reflection in RustFS's S3 listener exposes stored object data to cross-origin theft via browser-credentialed requests against all versions prior to 1.0.0-beta.2. When the RUSTFS_CORS_ALLOWED_ORIGINS environment variable is unset - the default state - the ConditionalCorsLayer middleware reflects any incoming Origin header verbatim as Access-Control-Allow-Origin while simultaneously asserting Access-Control-Allow-Credentials: true and Access-Control-Allow-Headers: *, including on preflight and error responses, nullifying the browser's same-origin policy protections. An unauthenticated attacker (PR:N) who lures a victim with ambient RustFS credentials to a malicious web page can exfiltrate object storage contents; no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis. The fix is vendor-released in 1.0.0-beta.2.
RustFS distributed object storage (all versions prior to 1.0.0-beta.2) leaks sensitive credentials - including SessionTokens (JWT), SecretAccessKeys, and full JWT claim payloads - in plaintext to server logs when debug-level logging is active. Any authenticated party with read access to those log files can harvest live credentials for lateral movement or unauthorized storage access. No public exploit identified at time of analysis, but the impact of credential exposure is high if debug logging is inadvertently enabled in production. A vendor-released patch is available in 1.0.0-beta.2.
Unauthenticated information disclosure in RustFS exposes parsed license metadata - including license subject and expiration timestamp - via the console endpoint GET /rustfs/console/license to any network client that can reach the console listener, with no credentials required. All RustFS releases prior to 1.0.0-beta.2 are affected. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, and the CVSS 4.0 confidentiality impact is rated Low given the non-sensitive nature of the disclosed data.
RustFS alpha versions prior to alpha.90 allow authenticated users with limited permissions to bypass authorization checks in the multipart copy operation (UploadPartCopy), enabling exfiltration of objects from buckets they cannot directly read. This breaks tenant isolation in multi-tenant deployments by allowing a low-privileged user to copy victim objects into their own multipart upload and complete the transfer without proper authorization validation.
RustFS is a distributed object storage system built in Rust. [CVSS 4.0 MEDIUM]
RustFS (alpha.13 to alpha.78) has a path traversal in /rustfs/rpc/read_file_stream that allows reading arbitrary files on the server. PoC available, fixed in alpha.79.