CVE-2026-27607

HIGH

RustFS 1.0.0-alpha.56-82 - Auth Bypass

Title source: llm

Description

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enables unauthorized file uploads exceeding size limits, uploads to arbitrary object keys, and content-type spoofing, potentially leading to storage exhaustion, unauthorized data access, and security bypasses. Version 1.0.0-alpha.83 fixes the issue.

Exploits (1)

nomisec WORKING POC

by nikeee · poc

https://github.com/nikeee/CVE-2026-27607

View Code ZIP pw:eip

References (1)

[Vendor Advisory] https://github.com/rustfs/rustfs/security/advisories/GHSA-w5fh-f8xh-5x3p

Scores

CVSS v3 8.1

EPSS 0.0010

EPSS Percentile 28.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Details

CWE

CWE-863 CWE-20

Status published

Products (2)

crates.io/rustfs 1.0.0-alpha.56 - 1.0.0-alpha.83crates.io

rustfs/rustfs 1.0.0 alpha56 (27 CPE variants)

Published Feb 25, 2026

Tracked Since Feb 25, 2026