rustfs

Records33All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high13CVSS 7.0–8.9

Exploited now

rustfs records in CISA KEV

No rustfs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Rustfs 12 records HIGH

Records

33 records

TI-2025-42382 CVE-2025-68926 · GHSA-h956-rh7x-ppgj

RustFS has a gRPC Hardcoded Token Authentication Bypass

HIGH 82

RustFS is a distributed object storage system built in Rust.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.3185 Published 2025-12-30 Fixed in 1.0.0-alpha.78 CWE-287

TI-2026-32895 CVE-2026-45044

RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers

HIGH 77

RustFS is a distributed object storage system built in Rust.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0031 Published 2026-05-28 Fixed in 1.0.0-beta.2 CWE-306

TI-2026-32892 CVE-2026-45041

RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery

HIGH 77

RustFS is a distributed object storage system built in Rust.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00239 Published 2026-05-28 Fixed in 1.0.0-beta.2 CWE-321

TI-2025-42176 CVE-2025-68705 · GHSA-pq29-69jg-9mxc

RustFS Path Traversal Vulnerability

HIGH 77

RustFS is a distributed object storage system built in Rust.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.07261 Published 2026-01-07 Fixed in 1.0.0-alpha.79 CWE-22

TI-2026-36822 CVE-2026-49991

RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection

HIGH 76

RustFS is a distributed object storage system built in Rust.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00415 Published 2026-06-26 No fix listed CWE-22

TI-2026-32894 CVE-2026-45043

RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root

HIGH 75

RustFS is a distributed object storage system built in Rust.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00226 Published 2026-05-29 Fixed in 1.0.0-beta.2 CWE-269

TI-2026-17564 CVE-2026-21862 · GHSA-fc6g-2gcp-2qrq

RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

HIGH 75

RustFS is a distributed object storage system built in Rust.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00251 Published 2026-02-03 Fixed in 1.0.0-alpha.78 CWE-290

TI-2026-44518 CVE-2026-62378

RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover

HIGH 74

RustFS Console is a web management console for the RustFS distributed file system.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00422 Published 2026-07-15 Fixed in 0.1.10 CWE-79

TI-2026-39869 CVE-2026-55188

RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials

HIGH 71

RustFS is a distributed object storage system built in Rust.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.00297 Published 2026-06-26 No fix listed CWE-200

TI-2026-51414 CVE-2026-73289

RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions

HIGH 70

RustFS is a distributed object storage system built in Rust.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00413 Published 2026-08-12 Fixed in 1.0.0-beta.12 CWE-863

TI-2026-19963 CVE-2026-24762 · GHSA-r54g-49rx-98cr

RustFS Logs Sensitive Credentials in Plaintext

HIGH 70

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00291 Published 2026-02-03 Fixed in 1.0.0-alpha.82 CWE-532

TI-2026-39870 CVE-2026-55189

RustFS: FTP frontend skips IAM authorization on object reads

HIGH 67

RustFS is a distributed object storage system built in Rust.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.0034 Published 2026-06-26 No fix listed CWE-862

TI-2026-32893 CVE-2026-45042

RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source

MEDIUM 64

RustFS is a distributed object storage system built in Rust.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00207 Published 2026-05-28 Fixed in 1.0.0-beta.2 CWE-863

TI-2025-42706 CVE-2025-69255 · GHSA-gw2x-q739-qhcr

RustFS gRPC GetMetrics deserialization panic enables remote DoS

MEDIUM 64

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00337 Published 2026-01-07 Fixed in 1.0.0-alpha.78 CWE-755

TI-2026-51415 CVE-2026-73290

RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback

MEDIUM 63

RustFS is a distributed object storage system built in Rust.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00417 Published 2026-08-12 Fixed in 1.0.0-beta.12 CWE-863

TI-2026-34316 CVE-2026-46685

RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console

MEDIUM 60

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00108 Published 2026-05-28 Fixed in 1.0.0-beta.2 CWE-306

TI-2026-17737 CVE-2026-22043 · GHSA-xgr5-qc6w-vcg9

RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

MEDIUM 59

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00419 Published 2026-01-08 Fixed in 1.0.0-alpha.79 CWE-269

TI-2026-17736 CVE-2026-22042 · GHSA-vcwh-pff9-64cc

RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

MEDIUM 59

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00435 Published 2026-01-08 Fixed in 1.0.0-alpha.79 CWE-285

TI-2026-51412 CVE-2026-73287

RustFS: FTPS MKD bypasses IAM CreateBucket authorization

MEDIUM 58

RustFS is a distributed object storage system built in Rust.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00368 Published 2026-08-12 Fixed in 1.0.0-beta.12 CWE-862

TI-2026-32891 CVE-2026-45040

RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]

MEDIUM 57

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00152 Published 2026-05-28 Fixed in 1.0.0-beta.2 CWE-312

TI-2026-28347 CVE-2026-39360 · GHSA-mx42-j6wv-px98

RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration

MEDIUM 57

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00205 Published 2026-04-07 No fix listed CWE-862

TI-2026-18300 CVE-2026-22782 · GHSA-333v-68xh-8mmq

RustFS RPC signature verification logs shared secret

MEDIUM 54

RustFS is a distributed object storage system built in Rust.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.00524 Published 2026-01-16 Fixed in 1.0.0-alpha.80 CWE-532

TI-2026-40303 CVE-2026-55838

RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics

MEDIUM 53

RustFS is a distributed object storage system built in Rust.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-06-26 No fix listed CWE-862

TI-2026-22174 CVE-2026-27822 · GHSA-v9fg-3cr2-277j

Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

MEDIUM 49

RustFS is a distributed object storage system built in Rust.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.05054 Published 2026-02-25 Fixed in 1.0.0-alpha.83 CWE-79

TI-2026-32890 CVE-2026-45039

RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation

MEDIUM 48

RustFS is a distributed object storage system built in Rust.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00268 Published 2026-05-28 Fixed in 1.0.0-beta.2 CWE-1392

Open these records in search →