What’s Vulnerable › Vulnerabilities
CVE-2026-21862: RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-03 · updated 2026-06-17
- Weakness: CWE-290
Description
RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies. This issue has been patched in version alpha.78.
Affected products
- rustfs: 1.0.0-alpha1, 1.0.0-alpha10, 1.0.0-alpha11, 1.0.0-alpha12, 1.0.0-alpha13, 1.0.0-alpha14 (+71)
References
Get alerted when CVE-2026-21862 or the next vulnerability affects your stack