What’s Vulnerable › Vulnerabilities

CVE-2026-22042: RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-08 · updated 2026-06-17
• Weakness: CWE-285

Description

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAction` instead of `ImportIAMAction`, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation. Version 1.0.0-alpha.79 fixes the issue.

Affected products

• rustfs: 1.0.0-alpha1, 1.0.0-alpha10, 1.0.0-alpha11, 1.0.0-alpha12, 1.0.0-alpha13, 1.0.0-alpha14 (+72)

References

• https://github.com/rustfs/rustfs/security/advisories/GHSA-vcwh-pff9-64cc
• https://github.com/rustfs/rustfs/security/advisories/GHSA-vcwh-pff9-64cc

Get alerted when CVE-2026-22042 or the next vulnerability affects your stack