What’s Vulnerable › Vulnerabilities

CVE-2026-22043: RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-08 · updated 2026-06-17
• Weakness: CWE-269

Description

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions. Version 1.0.0-alpha.79 fixes the issue.

Affected products

• rustfs: 1.0.0-alpha13, 1.0.0-alpha14, 1.0.0-alpha15, 1.0.0-alpha16, 1.0.0-alpha17, 1.0.0-alpha18 (+60)

References

• https://github.com/rustfs/rustfs/security/advisories/GHSA-xgr5-qc6w-vcg9
• https://github.com/rustfs/rustfs/security/advisories/GHSA-xgr5-qc6w-vcg9

Get alerted when CVE-2026-22043 or the next vulnerability affects your stack