Read the docs
TI-2026-29589 Aliases CVE-2026-40937GHSA-pfcq-4gjr-6gjm

Missing authorization in rustfs

Priority LOW 38CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rustfs/src/admin/handlers/event.rs` use a `check_permissions` helper that validates authentication only (access key + session token), without performing any admin-action authorization via `validate_admin_request`. Every other admin handler in the codebase correctly calls `validate_admin_request` with a specific `AdminAction`. This is the only admin handler file that skips authorization. A non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attacker-controlled endpoint. This enables cross-user event interception and audit evasion. 1.0.0-alpha.94 contains a patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00293 21st percentileScored 2026-11-07
Fix Fixed rustfs (rustfs): 1.0.0-alpha.94

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rustfsrustfsbefore 1.0.0-alpha.941.0.0-alpha.94Patch availableCNA
—rustfs (crates.io)up to 0.0.2—No fix listedGHSA-pfcq-4gjr-6gjm
  • rustfs Vendorrustfs Affected before 1.0.0-alpha.94 Fixed in 1.0.0-alpha.94 Patch available CNA
  • rustfs (crates.io) Vendor— Affected up to 0.0.2 Fixed in — No fix listed GHSA-pfcq-4gjr-6gjm

CPE configurations NVD · 93

CPEVersionsRoleVendor
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:*1.0.0 alpha1Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:*1.0.0 alpha10Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:*1.0.0 alpha11Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:*1.0.0 alpha12Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:*1.0.0 alpha13Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:*1.0.0 alpha14Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:*1.0.0 alpha15Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:*1.0.0 alpha16Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:*1.0.0 alpha17Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:*1.0.0 alpha18Vulnerablerustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:* Versions 1.0.0 alpha1 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:* Versions 1.0.0 alpha10 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:* Versions 1.0.0 alpha11 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:* Versions 1.0.0 alpha12 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:* Versions 1.0.0 alpha13 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:* Versions 1.0.0 alpha14 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:* Versions 1.0.0 alpha15 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:* Versions 1.0.0 alpha16 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:* Versions 1.0.0 alpha17 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:* Versions 1.0.0 alpha18 Vulnerable ·rustfs
Show 83 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:*1.0.0 alpha19Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:*1.0.0 alpha2Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:*1.0.0 alpha20Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:*1.0.0 alpha21Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:*1.0.0 alpha22Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:*1.0.0 alpha23Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:*1.0.0 alpha24Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:*1.0.0 alpha25Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:*1.0.0 alpha26Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:*1.0.0 alpha27Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:*1.0.0 alpha28Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:*1.0.0 alpha29Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:*1.0.0 alpha3Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:*1.0.0 alpha30Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:*1.0.0 alpha31Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:*1.0.0 alpha32Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:*1.0.0 alpha33Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:*1.0.0 alpha34Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:*1.0.0 alpha35Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:*1.0.0 alpha36Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:*1.0.0 alpha37Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:*1.0.0 alpha38Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:*1.0.0 alpha39Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:*1.0.0 alpha4Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:*1.0.0 alpha40Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:*1.0.0 alpha41Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:*1.0.0 alpha42Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:*1.0.0 alpha43Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:*1.0.0 alpha44Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:*1.0.0 alpha45Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:*1.0.0 alpha46Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:*1.0.0 alpha47Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:*1.0.0 alpha48Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:*1.0.0 alpha49Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:*1.0.0 alpha5Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:*1.0.0 alpha50Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:*1.0.0 alpha51Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:*1.0.0 alpha52Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:*1.0.0 alpha53Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:*1.0.0 alpha54Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:*1.0.0 alpha55Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:*1.0.0 alpha56Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:*1.0.0 alpha57Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:*1.0.0 alpha58Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:*1.0.0 alpha59Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:*1.0.0 alpha6Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:*1.0.0 alpha60Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:*1.0.0 alpha61Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:*1.0.0 alpha62Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:*1.0.0 alpha63Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:*1.0.0 alpha64Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:*1.0.0 alpha65Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:*1.0.0 alpha66Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:*1.0.0 alpha67Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:*1.0.0 alpha68Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:*1.0.0 alpha69Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:*1.0.0 alpha7Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:*1.0.0 alpha70Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:*1.0.0 alpha71Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:*1.0.0 alpha72Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:*1.0.0 alpha73Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:*1.0.0 alpha74Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:*1.0.0 alpha75Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:*1.0.0 alpha76Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:*1.0.0 alpha77Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:*1.0.0 alpha78Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79:*:*:*:rust:*:*1.0.0 alpha79Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:*1.0.0 alpha8Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80:*:*:*:rust:*:*1.0.0 alpha80Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81:*:*:*:rust:*:*1.0.0 alpha81Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82:*:*:*:rust:*:*1.0.0 alpha82Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha83:*:*:*:rust:*:*1.0.0 alpha83Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha84:*:*:*:rust:*:*1.0.0 alpha84Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha85:*:*:*:rust:*:*1.0.0 alpha85Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha86:*:*:*:rust:*:*1.0.0 alpha86Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha87:*:*:*:rust:*:*1.0.0 alpha87Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha88:*:*:*:rust:*:*1.0.0 alpha88Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha89:*:*:*:rust:*:*1.0.0 alpha89Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:*1.0.0 alpha9Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha90:*:*:*:rust:*:*1.0.0 alpha90Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha91:*:*:*:rust:*:*1.0.0 alpha91Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha92:*:*:*:rust:*:*1.0.0 alpha92Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha93:*:*:*:rust:*:*1.0.0 alpha93Vulnerablerustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:* Versions 1.0.0 alpha19 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:* Versions 1.0.0 alpha2 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:* Versions 1.0.0 alpha20 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:* Versions 1.0.0 alpha21 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:* Versions 1.0.0 alpha22 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:* Versions 1.0.0 alpha23 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:* Versions 1.0.0 alpha24 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:* Versions 1.0.0 alpha25 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:* Versions 1.0.0 alpha26 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:* Versions 1.0.0 alpha27 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:* Versions 1.0.0 alpha28 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:* Versions 1.0.0 alpha29 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:* Versions 1.0.0 alpha3 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:* Versions 1.0.0 alpha30 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:* Versions 1.0.0 alpha31 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:* Versions 1.0.0 alpha32 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:* Versions 1.0.0 alpha33 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:* Versions 1.0.0 alpha34 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:* Versions 1.0.0 alpha35 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:* Versions 1.0.0 alpha36 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:* Versions 1.0.0 alpha37 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:* Versions 1.0.0 alpha38 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:* Versions 1.0.0 alpha39 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:* Versions 1.0.0 alpha4 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:* Versions 1.0.0 alpha40 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:* Versions 1.0.0 alpha41 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:* Versions 1.0.0 alpha42 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:* Versions 1.0.0 alpha43 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:* Versions 1.0.0 alpha44 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:* Versions 1.0.0 alpha45 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:* Versions 1.0.0 alpha46 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:* Versions 1.0.0 alpha47 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:* Versions 1.0.0 alpha48 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:* Versions 1.0.0 alpha49 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:* Versions 1.0.0 alpha5 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:* Versions 1.0.0 alpha50 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:* Versions 1.0.0 alpha51 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:* Versions 1.0.0 alpha52 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:* Versions 1.0.0 alpha53 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:* Versions 1.0.0 alpha54 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:* Versions 1.0.0 alpha55 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:* Versions 1.0.0 alpha56 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:* Versions 1.0.0 alpha57 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:* Versions 1.0.0 alpha58 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:* Versions 1.0.0 alpha59 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:* Versions 1.0.0 alpha6 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:* Versions 1.0.0 alpha60 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:* Versions 1.0.0 alpha61 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:* Versions 1.0.0 alpha62 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:* Versions 1.0.0 alpha63 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:* Versions 1.0.0 alpha64 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:* Versions 1.0.0 alpha65 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:* Versions 1.0.0 alpha66 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:* Versions 1.0.0 alpha67 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:* Versions 1.0.0 alpha68 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:* Versions 1.0.0 alpha69 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:* Versions 1.0.0 alpha7 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:* Versions 1.0.0 alpha70 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:* Versions 1.0.0 alpha71 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:* Versions 1.0.0 alpha72 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:* Versions 1.0.0 alpha73 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:* Versions 1.0.0 alpha74 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:* Versions 1.0.0 alpha75 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:* Versions 1.0.0 alpha76 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:* Versions 1.0.0 alpha77 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:* Versions 1.0.0 alpha78 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79:*:*:*:rust:*:* Versions 1.0.0 alpha79 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:* Versions 1.0.0 alpha8 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80:*:*:*:rust:*:* Versions 1.0.0 alpha80 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81:*:*:*:rust:*:* Versions 1.0.0 alpha81 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82:*:*:*:rust:*:* Versions 1.0.0 alpha82 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha83:*:*:*:rust:*:* Versions 1.0.0 alpha83 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha84:*:*:*:rust:*:* Versions 1.0.0 alpha84 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha85:*:*:*:rust:*:* Versions 1.0.0 alpha85 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha86:*:*:*:rust:*:* Versions 1.0.0 alpha86 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha87:*:*:*:rust:*:* Versions 1.0.0 alpha87 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha88:*:*:*:rust:*:* Versions 1.0.0 alpha88 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha89:*:*:*:rust:*:* Versions 1.0.0 alpha89 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:* Versions 1.0.0 alpha9 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha90:*:*:*:rust:*:* Versions 1.0.0 alpha90 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha91:*:*:*:rust:*:* Versions 1.0.0 alpha91 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha92:*:*:*:rust:*:* Versions 1.0.0 alpha92 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha93:*:*:*:rust:*:* Versions 1.0.0 alpha93 Vulnerable ·rustfs

Remediation

  • Fix · CNA rustfs (rustfs) Fixed in 1.0.0-alpha.94

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40937
  2. 2026-10-03 Alias added: GHSA-pfcq-4gjr-6gjm

References

Advisory 2

Other 2

  • TI-2025-42382 RustFS has a gRPC Hardcoded Token Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2025-42176 RustFS Path Traversal Vulnerability CVSS 4.0HIGH 8.8
  • TI-2026-17564 RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers CVSS 4.0HIGH 7.7
  • TI-2026-19963 RustFS Logs Sensitive Credentials in Plaintext CVSS 4.0MEDIUM 6.9
  • TI-2025-42706 RustFS gRPC GetMetrics deserialization panic enables remote DoS CVSS 4.0MEDIUM 5.5
  • TI-2026-17737 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting CVSS 4.0MEDIUM 5.7
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences