github.com
https://github.com/rustfs/rustfs CVE-2026-39360
MEDIUM
RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration
Record summary
CVE-2026-39360 has a selected CVSS score of 5.3 (medium).
Description
RustFS is a distributed object storage system built in Rust. Prior to alpha.90, RustFS contains a missing authorization check in the multipart copy path (UploadPartCopy). A low-privileged user who cannot read objects from a victim bucket can still exfiltrate victim objects by copying them into an attacker-controlled multipart upload and completing the upload. This breaks tenant isolation in multi-user / multi-tenant deployments. This vulnerability is fixed in alpha.90.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 7, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
rustfsBrowse rustfs / rustfs | CVE List | < alpha.90 | affected |
| GitHub Advisory | Through 0.0.2 | affected |
References
3github.comConfirmation
https://github.com/rustfs/rustfs/security/advisories/GHSA-mx42-j6wv-px98 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-39360