CVE-2026-73286

Summary: The CVE-2026-73286 issue affects RustFS prior to 1.0.0-beta.12. The vulnerability arises because get_condition_values folds attacker-controlled request headers from HeaderMap into server-derived identity keys (userid, username, principaltype, groups, versionid, signatureversion, jwt:, ld...

EUVD-2026-57230

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS getconditionvalues folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowin...

CVE-2026-73286 RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS getconditionvalues folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowin...

EUVD-2026-57229

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

CVE-2026-73285

RustFS (distributed object storage in Rust) up to version 1.0.0-rc.1 is affected. The external OPA authorization configured via RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs incorrectly sets PreparedIamAuth.needs_existing_object_tag for PreparedIamMode::Opa, which can cause maybe_merge_object...

CVE-2026-73285 RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

CVE-2026-73284 RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts

RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/serviceaccount.rs accepts an attacker-controlled targetuser after only checking CreateServiceAccountAdminAction, passes it to newserviceaccount, and prepareserviceaccountauth sets...

EUVD-2026-57228

RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/serviceaccount.rs accepts an attacker-controlled targetuser after only checking CreateServiceAccountAdminAction, passes it to newserviceaccount, and prepareserviceaccountauth sets...

CVE-2026-73284

RustFS is vulnerable in the AddServiceAccount handler (rustfs/src/admin/handlers/service_account.rs), where an attacker-controlled target_user is accepted after only validating CreateServiceAccountAdminAction, leading to the root-parent service account being marked as is_owner. This could enable ...

CVE-2026-73284 RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts

RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/serviceaccount.rs accepts an attacker-controlled targetuser after only checking CreateServiceAccountAdminAction, passes it to newserviceaccount, and prepareserviceaccountauth sets...

CVE-2026-73265

Vulnerability (CVE-2026-73265) : In RustFS, the GetObject/CopyObject/UploadPartCopy paths incorrectly authorize reads of historical versions using s3:GetObject instead of s3:GetObjectVersion, enabling principals without historical-version permissions to disclose known historical content. This aff...

CVE-2026-73265 RustFS: Version-specific object reads authorize the non-version action

RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known...

CVE-2026-73265 RustFS: Version-specific object reads authorize the non-version action

RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known...

PT-2026-71089

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get condition values folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys,...

PT-2026-71086

RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known...

PT-2026-71093

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy allowed path applies deny anonymo...

PT-2026-71090

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by calling storage.create bucket without authorize operation for S3Action::CreateBucket, allowing authenticated FTPS users denied...

PT-2026-71087

RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/service account.rs accepts an attacker-controlled target user after only checking CreateServiceAccountAdminAction, passes it to new service account, and prepare service account auth...

PT-2026-71088

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS POLICY PLUGIN URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs existing object tag incorrectly for PreparedIamMode::Opa, causing maybe merg...

PT-2026-71092

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's...