CVE-2026-73287

MEDIUM

RustFS: FTPS MKD bypasses IAM CreateBucket authorization

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-73287 has a selected CVSS score of 5.4 (medium).

Description

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by calling storage.create_bucket without authorize_operation for S3Action::CreateBucket, allowing authenticated FTPS users denied s3:CreateBucket to create buckets. This issue is fixed in version 1.0.0-beta.12.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 13, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

rustfs

Browse rustfs / rustfs
CVE List< 1.0.0-beta.12affected

References

3