Vulnerabilities

TI-2026-29589 CVE-2026-40937 · GHSA-pfcq-4gjr-6gjm

Missing authorization in rustfs

LOW 38

RustFS is a distributed object storage system built in Rust.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00293 Published 2026-04-22 Fixed in 1.0.0-alpha.94 CWE-862

TI-2026-28347 CVE-2026-39360 · GHSA-mx42-j6wv-px98

RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration

MEDIUM 57

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00205 Published 2026-04-07 No fix listed CWE-862

TI-2026-22174 CVE-2026-27822 · GHSA-v9fg-3cr2-277j

Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

MEDIUM 49

RustFS is a distributed object storage system built in Rust.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.05054 Published 2026-02-25 Fixed in 1.0.0-alpha.83 CWE-79

TI-2026-21993 CVE-2026-27607 · GHSA-w5fh-f8xh-5x3p

RustFS's Missing Post Policy Validation leads to Arbitrary Object Write

MEDIUM 41

RustFS is a distributed object storage system built in Rust.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00369 Published 2026-02-25 Fixed in 1.0.0-alpha.83 CWE-20

TI-2026-19963 CVE-2026-24762 · GHSA-r54g-49rx-98cr

RustFS Logs Sensitive Credentials in Plaintext

HIGH 70

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00291 Published 2026-02-03 Fixed in 1.0.0-alpha.82 CWE-532

TI-2026-17564 CVE-2026-21862 · GHSA-fc6g-2gcp-2qrq

RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

HIGH 75

RustFS is a distributed object storage system built in Rust.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00251 Published 2026-02-03 Fixed in 1.0.0-alpha.78 CWE-290

TI-2026-18300 CVE-2026-22782 · GHSA-333v-68xh-8mmq

RustFS RPC signature verification logs shared secret

MEDIUM 54

RustFS is a distributed object storage system built in Rust.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.00524 Published 2026-01-16 Fixed in 1.0.0-alpha.80 CWE-532

TI-2026-17737 CVE-2026-22043 · GHSA-xgr5-qc6w-vcg9

RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

MEDIUM 59

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00419 Published 2026-01-08 Fixed in 1.0.0-alpha.79 CWE-269

TI-2026-17736 CVE-2026-22042 · GHSA-vcwh-pff9-64cc

RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

MEDIUM 59

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00435 Published 2026-01-08 Fixed in 1.0.0-alpha.79 CWE-285

TI-2025-42706 CVE-2025-69255 · GHSA-gw2x-q739-qhcr

RustFS gRPC GetMetrics deserialization panic enables remote DoS

MEDIUM 64

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00337 Published 2026-01-07 Fixed in 1.0.0-alpha.78 CWE-755

TI-2025-42176 CVE-2025-68705 · GHSA-pq29-69jg-9mxc

RustFS Path Traversal Vulnerability

HIGH 77

RustFS is a distributed object storage system built in Rust.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.07261 Published 2026-01-07 Fixed in 1.0.0-alpha.79 CWE-22

TI-2025-42382 CVE-2025-68926 · GHSA-h956-rh7x-ppgj

RustFS has a gRPC Hardcoded Token Authentication Bypass

HIGH 82

RustFS is a distributed object storage system built in Rust.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.3185 Published 2025-12-30 Fixed in 1.0.0-alpha.78 CWE-287

Vulnerabilities

Filters