crates.io Package Vulnerabilities
Vulnerabilities associated with rustfs.
Packages
Clear package- surrealdb52 vulnerabilities
- wasmtime39 vulnerabilities
- deno37 vulnerabilities
- zebrad27 vulnerabilities
- openssl-src26 vulnerabilities
- ckb22 vulnerabilities
- coreutils21 vulnerabilities
- openssl18 vulnerabilities
- rusqlite16 vulnerabilities
- russh15 vulnerabilities
- apollo-router13 vulnerabilities
- rustfs13 vulnerabilities
- tough10 vulnerabilities
- cargo8 vulnerabilities
- gix8 vulnerabilities
- surrealdb-core8 vulnerabilities
- gitoxide7 vulnerabilities
- hyper7 vulnerabilities
- pyo37 vulnerabilities
- routinator7 vulnerabilities
- vaultwarden7 vulnerabilities
- Simple-Wayland-HotKey-Daemon6 vulnerabilities
- astral-tokio-tar6 vulnerabilities
- cranelift-codegen6 vulnerabilities
- deno_runtime6 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover## Summary `ListServiceAccount` (`GET /rustfs/admin/v3/list-service-accounts?user=<other>`) authorizes cross-user requests against `UpdateServiceAccountAdminAction` instead of `ListServiceAccountsAdminAction` at `rustfs/src/admin/handlers/service_account.rs:936`. The handler accepts the **wrong** admin action and rejects the **correct** one: - A user granted only `admin:UpdateServiceAccount` enumerates every service account in the cluster, including the root user's (HTTP 200, full metadata). -… CWE-863May 5, 2026 | CVSS-v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-40937HIGH | RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooksRustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rustfs/src/admin/handlers/event.rs` use a `check_permissions` helper that validates authentication only (access key + session token), without performing any admin-action authorization via `validate_admin_request`. Every other admin handler in the codebase correctly calls `validate_admin_request` with a specific `AdminAction`. This is the only admin handler fi… CWE-862Apr 22, 2026 | CVSS8.3v3.1 | EPSS0.293% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-39360MEDIUM | RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltrationRustFS is a distributed object storage system built in Rust. Prior to alpha.90, RustFS contains a missing authorization check in the multipart copy path (UploadPartCopy). A low-privileged user who cannot read objects from a victim bucket can still exfiltrate victim objects by copying them into an attacker-controlled multipart upload and completing the upload. This breaks tenant isolation in multi-user / multi-tenant deployments. This vulnerability is fixed in alpha.90. CWE-862Apr 7, 2026 | CVSS5.3v4.0 | EPSS0.201% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-27822CRITICAL | Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account TakeoverRustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an attacker can steal administrator credentials from `localStorage`, leading to full account takeover and system compromise. Version 1.0.0-alpha.83 fixes the issue. CWE-79Feb 25, 2026 | CVSS9.1v3.1 | EPSS4.22% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-27607HIGH | RustFS's Missing Post Policy Validation leads to Arbitrary Object WriteRustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enables unauthorized file uploads exceeding size limits, uploads to arbitrary object keys, and content-type spoofing, potentially leading to storage exhaustion, unauthorized data access, and security bypass… | CVSS8.1v3.1 | EPSS0.265% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-24762MEDIUM | RustFS Logs Sensitive Credentials in PlaintextRustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material (access key, secret key, session token) to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be accessible to internal or external log consumers and could lead to compromise of sensitive credentials. This issue has been patched in version alpha.82. CWE-532Feb 3, 2026 | CVSS6.9v4.0 | EPSS0.245% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21862HIGH | RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headersRustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies. This issue has been patched in version alpha.78. CWE-290Feb 3, 2026 | CVSS7.7v4.0 | EPSS0.211% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
RustFS RPC signature verification logs shared secretRustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls. In crates/ecstore/src/rpc/http_auth.rs, the invalid signature branch logs sensitive data. This log line includes secret and expected_signature, both derived from the shared HMAC key. Any invalidly signed request triggers this path. … CWE-532Jan 16, 2026 | CVSS2.9v4.0 | EPSS0.472% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-22043MEDIUM | RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account MintingRustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions. Version 1.0.0-alpha.79 fixes the issue. | CVSS5.7v4.0 | EPSS0.393% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-22042MEDIUM | RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege EscalationRustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAction` instead of `ImportIAMAction`, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation. Version 1.0.0-alpha.79… | CVSS5.7v4.0 | EPSS0.407% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-69255MEDIUM | RustFS gRPC GetMetrics deserialization panic enables remote DoSRustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler thread and enabling remote denial of service of the metrics endpoint. This issue has been patched in version 1.0.0-alpha.78. CWE-755Jan 7, 2026 | CVSS5.5v4.0 | EPSS0.295% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-68705HIGH | RustFS Path Traversal VulnerabilityRustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in the /rustfs/rpc/read_file_stream endpoint. This issue has been patched in version 1.0.0-alpha.79. CWE-22Jan 7, 2026 | CVSS8.8v4.0 | EPSS6.81% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-68926CRITICAL | RustFS has a gRPC Hardcoded Token Authentication BypassRustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute … | CVSS9.8v3.1 | EPSS29% | PoCs3 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |