Vulnerabilities

TI-2026-51415 CVE-2026-73290

RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback

MEDIUM 63

RustFS is a distributed object storage system built in Rust.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00417 Published 2026-08-12 Fixed in 1.0.0-beta.12 CWE-863

TI-2026-51414 CVE-2026-73289

RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions

HIGH 70

RustFS is a distributed object storage system built in Rust.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00413 Published 2026-08-12 Fixed in 1.0.0-beta.12 CWE-863

TI-2026-51413 CVE-2026-73288

Protection mechanism failure in rustfs

LOW 29

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.00394 Published 2026-08-12 Fixed in 1.0.0-rc.1 CWE-693

TI-2026-51412 CVE-2026-73287

RustFS: FTPS MKD bypasses IAM CreateBucket authorization

MEDIUM 58

RustFS is a distributed object storage system built in Rust.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00368 Published 2026-08-12 Fixed in 1.0.0-beta.12 CWE-862

TI-2026-51411 CVE-2026-73286

Incorrect authorization in rustfs

LOW 38

RustFS is a distributed object storage system built in Rust.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00426 Published 2026-08-12 Fixed in 1.0.0-beta.12 CWE-863

TI-2026-51410 CVE-2026-73285

Incorrect authorization in rustfs

LOW 35

RustFS is a distributed object storage system built in Rust.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00465 Published 2026-08-12 Fixed in 1.0.0-rc.1 CWE-863

TI-2026-51409 CVE-2026-73284

RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts

MEDIUM 41

RustFS is a distributed object storage system built in Rust.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00523 Published 2026-08-12 Fixed in 1.0.0-beta.11 CWE-269

TI-2026-51399 CVE-2026-73265

RustFS: Version-specific object reads authorize the non-version action

LOW 29

RustFS is a distributed object storage system built in Rust.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00415 Published 2026-08-12 Fixed in 1.0.0-beta.11 CWE-862

TI-2026-44518 CVE-2026-62378

RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover

HIGH 74

RustFS Console is a web management console for the RustFS distributed file system.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00422 Published 2026-07-15 Fixed in 0.1.10 CWE-79

TI-2026-39869 CVE-2026-55188

RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials

HIGH 71

RustFS is a distributed object storage system built in Rust.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.00297 Published 2026-06-26 No fix listed CWE-200

TI-2026-36822 CVE-2026-49991

RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection

HIGH 76

RustFS is a distributed object storage system built in Rust.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00415 Published 2026-06-26 No fix listed CWE-22

TI-2026-39870 CVE-2026-55189

RustFS: FTP frontend skips IAM authorization on object reads

HIGH 67

RustFS is a distributed object storage system built in Rust.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.0034 Published 2026-06-26 No fix listed CWE-862

TI-2026-40303 CVE-2026-55838

RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics

MEDIUM 53

RustFS is a distributed object storage system built in Rust.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-06-26 No fix listed CWE-862

TI-2026-32894 CVE-2026-45043

RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root

HIGH 75

RustFS is a distributed object storage system built in Rust.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00226 Published 2026-05-29 Fixed in 1.0.0-beta.2 CWE-269

TI-2026-34316 CVE-2026-46685

RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console

MEDIUM 60

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00108 Published 2026-05-28 Fixed in 1.0.0-beta.2 CWE-306

TI-2026-32890 CVE-2026-45039

RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation

MEDIUM 48

RustFS is a distributed object storage system built in Rust.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00268 Published 2026-05-28 Fixed in 1.0.0-beta.2 CWE-1392

TI-2026-32891 CVE-2026-45040

RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]

MEDIUM 57

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00152 Published 2026-05-28 Fixed in 1.0.0-beta.2 CWE-312

TI-2026-32892 CVE-2026-45041

RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery

HIGH 77

RustFS is a distributed object storage system built in Rust.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00239 Published 2026-05-28 Fixed in 1.0.0-beta.2 CWE-321

TI-2026-32893 CVE-2026-45042

RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source

MEDIUM 64

RustFS is a distributed object storage system built in Rust.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00207 Published 2026-05-28 Fixed in 1.0.0-beta.2 CWE-863

TI-2026-32895 CVE-2026-45044

RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers

HIGH 77

RustFS is a distributed object storage system built in Rust.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0031 Published 2026-05-28 Fixed in 1.0.0-beta.2 CWE-306

TI-2026-34727 CVE-2026-47136

RustFS: Unauthenticated RustFS console license endpoint exposes license metadata

LOW 30

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0031 Published 2026-05-28 Fixed in 1.0.0-beta.2 CWE-200

TI-2026-29589 CVE-2026-40937 · GHSA-pfcq-4gjr-6gjm

Missing authorization in rustfs

LOW 38

RustFS is a distributed object storage system built in Rust.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00293 Published 2026-04-22 Fixed in 1.0.0-alpha.94 CWE-862

TI-2026-28347 CVE-2026-39360 · GHSA-mx42-j6wv-px98

RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration

MEDIUM 57

RustFS is a distributed object storage system built in Rust.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00205 Published 2026-04-07 No fix listed CWE-862

TI-2026-22174 CVE-2026-27822 · GHSA-v9fg-3cr2-277j

Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

MEDIUM 49

RustFS is a distributed object storage system built in Rust.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.05054 Published 2026-02-25 Fixed in 1.0.0-alpha.83 CWE-79

TI-2026-21993 CVE-2026-27607 · GHSA-w5fh-f8xh-5x3p

RustFS's Missing Post Policy Validation leads to Arbitrary Object Write

MEDIUM 41

RustFS is a distributed object storage system built in Rust.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00369 Published 2026-02-25 Fixed in 1.0.0-alpha.83 CWE-20

Vulnerabilities

Filters