Read the docs
TI-2026-39869 Aliases CVE-2026-55188

RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials

Priority HIGH 71CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-862.

Summary

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an authenticated user with no effective bucket or admin permissions can list remote replication target configuration for a bucket. Because the returned BucketTarget objects include remote target credentials, this can disclose replication access keys and secret keys. This vulnerability is fixed in 1.0.0-beta.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rustfsrustfs1.0.0-alpha.1 – 1.0.0-beta.8—No fix listedCNA
  • rustfs Vendorrustfs Affected 1.0.0-alpha.1 – 1.0.0-beta.8 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:rustfs:rustfs:*:*:*:*:*:*:*:*——rustfs
  • cpe:2.3:a:rustfs:rustfs:*:*:*:*:*:*:*:* Versions — — ·rustfs

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55188

References

Other 1

  • TI-2025-42382 RustFS has a gRPC Hardcoded Token Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2026-32895 RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers CVSS 4.0HIGH 8.8
  • TI-2026-32892 RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery CVSS 4.0HIGH 8.7
  • TI-2025-42176 RustFS Path Traversal Vulnerability CVSS 4.0HIGH 8.8
  • TI-2026-36822 RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection CVSS 3.1HIGH 8.6
  • TI-2026-32894 RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root CVSS 4.0CRITICAL 9.3
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences