Read the docs
TI-2026-21993 Aliases CVE-2026-27607GHSA-w5fh-f8xh-5x3p

RustFS's Missing Post Policy Validation leads to Arbitrary Object Write

Priority MEDIUM 41CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enables unauthorized file uploads exceeding size limits, uploads to arbitrary object keys, and content-type spoofing, potentially leading to storage exhaustion, unauthorized data access, and security bypasses. Version 1.0.0-alpha.83 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00369 30th percentileScored 2026-11-07
Fix Fixed rustfs (rustfs): 1.0.0-alpha.83rustfs (crates.io): 1.0.0-alpha.83

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rustfsrustfs1.0.0-alpha.56 to before 1.0.0-alpha.831.0.0-alpha.83Patch availableCNA
—rustfs (crates.io)1.0.0-alpha.56 to before 1.0.0-alpha.831.0.0-alpha.83Patch availableGHSA-w5fh-f8xh-5x3p
  • rustfs Vendorrustfs Affected 1.0.0-alpha.56 to before 1.0.0-alpha.83 Fixed in 1.0.0-alpha.83 Patch available CNA
  • rustfs (crates.io) Vendor— Affected 1.0.0-alpha.56 to before 1.0.0-alpha.83 Fixed in 1.0.0-alpha.83 Patch available GHSA-w5fh-f8xh-5x3p

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:*1.0.0 alpha56Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:*1.0.0 alpha57Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:*1.0.0 alpha58Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:*1.0.0 alpha59Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:*1.0.0 alpha60Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:*1.0.0 alpha61Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:*1.0.0 alpha62Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:*1.0.0 alpha63Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:*1.0.0 alpha64Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:*1.0.0 alpha65Vulnerablerustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:* Versions 1.0.0 alpha56 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:* Versions 1.0.0 alpha57 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:* Versions 1.0.0 alpha58 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:* Versions 1.0.0 alpha59 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:* Versions 1.0.0 alpha60 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:* Versions 1.0.0 alpha61 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:* Versions 1.0.0 alpha62 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:* Versions 1.0.0 alpha63 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:* Versions 1.0.0 alpha64 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:* Versions 1.0.0 alpha65 Vulnerable ·rustfs
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:*1.0.0 alpha66Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:*1.0.0 alpha67Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:*1.0.0 alpha68Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:*1.0.0 alpha69Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:*1.0.0 alpha70Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:*1.0.0 alpha71Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:*1.0.0 alpha72Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:*1.0.0 alpha73Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:*1.0.0 alpha74Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:*1.0.0 alpha75Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:*1.0.0 alpha76Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:*1.0.0 alpha77Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:*1.0.0 alpha78Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79:*:*:*:rust:*:*1.0.0 alpha79Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80:*:*:*:rust:*:*1.0.0 alpha80Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81:*:*:*:rust:*:*1.0.0 alpha81Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82:*:*:*:rust:*:*1.0.0 alpha82Vulnerablerustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:* Versions 1.0.0 alpha66 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:* Versions 1.0.0 alpha67 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:* Versions 1.0.0 alpha68 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:* Versions 1.0.0 alpha69 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:* Versions 1.0.0 alpha70 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:* Versions 1.0.0 alpha71 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:* Versions 1.0.0 alpha72 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:* Versions 1.0.0 alpha73 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:* Versions 1.0.0 alpha74 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:* Versions 1.0.0 alpha75 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:* Versions 1.0.0 alpha76 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:* Versions 1.0.0 alpha77 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:* Versions 1.0.0 alpha78 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79:*:*:*:rust:*:* Versions 1.0.0 alpha79 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80:*:*:*:rust:*:* Versions 1.0.0 alpha80 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81:*:*:*:rust:*:* Versions 1.0.0 alpha81 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82:*:*:*:rust:*:* Versions 1.0.0 alpha82 Vulnerable ·rustfs

Remediation

  • Fix · CNA rustfs (rustfs) Fixed in 1.0.0-alpha.83
  • Fix · GHSA-w5fh-f8xh-5x3p rustfs (crates.io) Fixed in 1.0.0-alpha.83 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27607
  2. 2026-10-03 Alias added: GHSA-w5fh-f8xh-5x3p

References

Advisory 2

Other 2

  • TI-2025-42382 RustFS has a gRPC Hardcoded Token Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2025-42176 RustFS Path Traversal Vulnerability CVSS 4.0HIGH 8.8
  • TI-2026-17564 RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers CVSS 4.0HIGH 7.7
  • TI-2026-19963 RustFS Logs Sensitive Credentials in Plaintext CVSS 4.0MEDIUM 6.9
  • TI-2025-42706 RustFS gRPC GetMetrics deserialization panic enables remote DoS CVSS 4.0MEDIUM 5.5
  • TI-2026-17737 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting CVSS 4.0MEDIUM 5.7
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences