Read the docs
TI-2026-22174 Aliases CVE-2026-27822GHSA-v9fg-3cr2-277j

Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

Priority MEDIUM 49CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an attacker can steal administrator credentials from `localStorage`, leading to full account takeover and system compromise. Version 1.0.0-alpha.83 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05054 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed rustfs (rustfs): 1.0.0-alpha.83rustfs (crates.io): 1.0.0-alpha.83

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rustfsrustfsbefore 1.0.0-alpha.831.0.0-alpha.83Patch availableCNA
—rustfs (crates.io)before 1.0.0-alpha.831.0.0-alpha.83Patch availableGHSA-v9fg-3cr2-277j
  • rustfs Vendorrustfs Affected before 1.0.0-alpha.83 Fixed in 1.0.0-alpha.83 Patch available CNA
  • rustfs (crates.io) Vendor— Affected before 1.0.0-alpha.83 Fixed in 1.0.0-alpha.83 Patch available GHSA-v9fg-3cr2-277j

CPE configurations NVD · 82

CPEVersionsRoleVendor
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:*1.0.0 alpha1Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:*1.0.0 alpha10Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:*1.0.0 alpha11Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:*1.0.0 alpha12Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:*1.0.0 alpha13Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:*1.0.0 alpha14Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:*1.0.0 alpha15Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:*1.0.0 alpha16Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:*1.0.0 alpha17Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:*1.0.0 alpha18Vulnerablerustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:* Versions 1.0.0 alpha1 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:* Versions 1.0.0 alpha10 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:* Versions 1.0.0 alpha11 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:* Versions 1.0.0 alpha12 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:* Versions 1.0.0 alpha13 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:* Versions 1.0.0 alpha14 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:* Versions 1.0.0 alpha15 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:* Versions 1.0.0 alpha16 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:* Versions 1.0.0 alpha17 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:* Versions 1.0.0 alpha18 Vulnerable ·rustfs
Show 72 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:*1.0.0 alpha19Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:*1.0.0 alpha2Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:*1.0.0 alpha20Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:*1.0.0 alpha21Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:*1.0.0 alpha22Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:*1.0.0 alpha23Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:*1.0.0 alpha24Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:*1.0.0 alpha25Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:*1.0.0 alpha26Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:*1.0.0 alpha27Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:*1.0.0 alpha28Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:*1.0.0 alpha29Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:*1.0.0 alpha3Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:*1.0.0 alpha30Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:*1.0.0 alpha31Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:*1.0.0 alpha32Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:*1.0.0 alpha33Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:*1.0.0 alpha34Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:*1.0.0 alpha35Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:*1.0.0 alpha36Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:*1.0.0 alpha37Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:*1.0.0 alpha38Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:*1.0.0 alpha39Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:*1.0.0 alpha4Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:*1.0.0 alpha40Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:*1.0.0 alpha41Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:*1.0.0 alpha42Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:*1.0.0 alpha43Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:*1.0.0 alpha44Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:*1.0.0 alpha45Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:*1.0.0 alpha46Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:*1.0.0 alpha47Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:*1.0.0 alpha48Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:*1.0.0 alpha49Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:*1.0.0 alpha5Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:*1.0.0 alpha50Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:*1.0.0 alpha51Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:*1.0.0 alpha52Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:*1.0.0 alpha53Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:*1.0.0 alpha54Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:*1.0.0 alpha55Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:*1.0.0 alpha56Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:*1.0.0 alpha57Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:*1.0.0 alpha58Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:*1.0.0 alpha59Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:*1.0.0 alpha6Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:*1.0.0 alpha60Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:*1.0.0 alpha61Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:*1.0.0 alpha62Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:*1.0.0 alpha63Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:*1.0.0 alpha64Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:*1.0.0 alpha65Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:*1.0.0 alpha66Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:*1.0.0 alpha67Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:*1.0.0 alpha68Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:*1.0.0 alpha69Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:*1.0.0 alpha7Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:*1.0.0 alpha70Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:*1.0.0 alpha71Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:*1.0.0 alpha72Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:*1.0.0 alpha73Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:*1.0.0 alpha74Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:*1.0.0 alpha75Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:*1.0.0 alpha76Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:*1.0.0 alpha77Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:*1.0.0 alpha78Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79:*:*:*:rust:*:*1.0.0 alpha79Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:*1.0.0 alpha8Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80:*:*:*:rust:*:*1.0.0 alpha80Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81:*:*:*:rust:*:*1.0.0 alpha81Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82:*:*:*:rust:*:*1.0.0 alpha82Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:*1.0.0 alpha9Vulnerablerustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:* Versions 1.0.0 alpha19 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:* Versions 1.0.0 alpha2 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:* Versions 1.0.0 alpha20 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:* Versions 1.0.0 alpha21 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:* Versions 1.0.0 alpha22 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:* Versions 1.0.0 alpha23 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:* Versions 1.0.0 alpha24 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:* Versions 1.0.0 alpha25 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:* Versions 1.0.0 alpha26 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:* Versions 1.0.0 alpha27 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:* Versions 1.0.0 alpha28 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:* Versions 1.0.0 alpha29 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:* Versions 1.0.0 alpha3 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:* Versions 1.0.0 alpha30 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:* Versions 1.0.0 alpha31 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:* Versions 1.0.0 alpha32 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:* Versions 1.0.0 alpha33 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:* Versions 1.0.0 alpha34 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:* Versions 1.0.0 alpha35 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:* Versions 1.0.0 alpha36 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:* Versions 1.0.0 alpha37 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:* Versions 1.0.0 alpha38 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:* Versions 1.0.0 alpha39 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:* Versions 1.0.0 alpha4 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:* Versions 1.0.0 alpha40 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:* Versions 1.0.0 alpha41 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:* Versions 1.0.0 alpha42 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:* Versions 1.0.0 alpha43 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:* Versions 1.0.0 alpha44 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:* Versions 1.0.0 alpha45 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:* Versions 1.0.0 alpha46 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:* Versions 1.0.0 alpha47 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:* Versions 1.0.0 alpha48 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:* Versions 1.0.0 alpha49 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:* Versions 1.0.0 alpha5 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:* Versions 1.0.0 alpha50 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:* Versions 1.0.0 alpha51 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:* Versions 1.0.0 alpha52 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:* Versions 1.0.0 alpha53 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:* Versions 1.0.0 alpha54 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:* Versions 1.0.0 alpha55 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:* Versions 1.0.0 alpha56 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:* Versions 1.0.0 alpha57 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:* Versions 1.0.0 alpha58 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:* Versions 1.0.0 alpha59 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:* Versions 1.0.0 alpha6 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:* Versions 1.0.0 alpha60 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:* Versions 1.0.0 alpha61 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:* Versions 1.0.0 alpha62 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:* Versions 1.0.0 alpha63 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:* Versions 1.0.0 alpha64 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:* Versions 1.0.0 alpha65 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:* Versions 1.0.0 alpha66 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:* Versions 1.0.0 alpha67 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:* Versions 1.0.0 alpha68 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:* Versions 1.0.0 alpha69 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:* Versions 1.0.0 alpha7 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:* Versions 1.0.0 alpha70 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:* Versions 1.0.0 alpha71 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:* Versions 1.0.0 alpha72 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:* Versions 1.0.0 alpha73 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:* Versions 1.0.0 alpha74 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:* Versions 1.0.0 alpha75 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:* Versions 1.0.0 alpha76 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:* Versions 1.0.0 alpha77 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:* Versions 1.0.0 alpha78 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79:*:*:*:rust:*:* Versions 1.0.0 alpha79 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:* Versions 1.0.0 alpha8 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80:*:*:*:rust:*:* Versions 1.0.0 alpha80 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81:*:*:*:rust:*:* Versions 1.0.0 alpha81 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82:*:*:*:rust:*:* Versions 1.0.0 alpha82 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:* Versions 1.0.0 alpha9 Vulnerable ·rustfs

Remediation

  • Fix · CNA rustfs (rustfs) Fixed in 1.0.0-alpha.83
  • Fix · GHSA-v9fg-3cr2-277j rustfs (crates.io) Fixed in 1.0.0-alpha.83 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27822
  2. 2026-10-03 Alias added: GHSA-v9fg-3cr2-277j
  3. 2026-10-25 EPSS moved to the 90th–95th percentile

References

Exploit 1

Advisory 1

Other 2

  • TI-2025-42382 RustFS has a gRPC Hardcoded Token Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2025-42176 RustFS Path Traversal Vulnerability CVSS 4.0HIGH 8.8
  • TI-2026-17564 RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers CVSS 4.0HIGH 7.7
  • TI-2026-19963 RustFS Logs Sensitive Credentials in Plaintext CVSS 4.0MEDIUM 6.9
  • TI-2025-42706 RustFS gRPC GetMetrics deserialization panic enables remote DoS CVSS 4.0MEDIUM 5.5
  • TI-2026-17737 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting CVSS 4.0MEDIUM 5.7
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences