What’s Vulnerable › Products
rustfs vulnerabilities
32 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 32 published in the last 12 months.
Check whether your rustfs version is affected
Latest rustfs vulnerabilities
- CVE-2026-73290 — RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback (CVSS 5.3)
- CVE-2026-73289 — RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions (CVSS 8.1)
- CVE-2026-73288 — RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted (CVSS 6.1)
- CVE-2026-73287 — RustFS: FTPS MKD bypasses IAM CreateBucket authorization (CVSS 5.4)
- CVE-2026-73286 — RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions (CVSS 8.1)
- CVE-2026-73285 — RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged (CVSS 7.5)
- CVE-2026-73284 — RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts (CVSS 8.8)
- CVE-2026-73265 — RustFS: Version-specific object reads authorize the non-version action (CVSS 6.5)
- CVE-2026-55838 — RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics (CVSS 4.3)
- CVE-2026-55189 — RustFS: FTP frontend skips IAM authorization on object reads (CVSS 7.7)
- CVE-2026-55188 — RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials (CVSS 8.2)
- CVE-2026-49991 — RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection (CVSS 8.6)
- CVE-2026-45043 — RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root (CVSS 9.3)
- CVE-2026-47136 — RustFS: Unauthenticated RustFS console license endpoint exposes license metadata (CVSS 6.9)
- CVE-2026-46685 — RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console (CVSS 6.0)
- CVE-2026-45044 — RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers (CVSS 8.8)
- CVE-2026-45042 — RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source (CVSS 7.1)
- CVE-2026-45041 — RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery (CVSS 8.7)
- CVE-2026-45040 — RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode] (CVSS 5.3)
- CVE-2026-45039 — RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation (CVSS 9.8)
- CVE-2026-40937 — RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks (CVSS 8.3)
- CVE-2026-39360 — RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration (CVSS 4.3)
- CVE-2026-27822 — Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover (CVSS 5.4)
- CVE-2026-27607 — RustFS's Missing Post Policy Validation leads to Arbitrary Object Write (CVSS 9.1)
- CVE-2026-24762 — RustFS Logs Sensitive Credentials in Plaintext (CVSS 7.5)