PT-2026-71093

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy allowed path applies deny anonymo...

CVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

CVE-2026-68153

In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmapshow after cephmoncst...

EUVD-2026-55544

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory accesses may occur in decodenewupstateweight. This happens because th...

CVE-2026-68158

CVE-2026-68158 (Linux kernel libceph) : A vulnerability in decoding CEPH_MSG_OSD_MAP can overflow when computing the length of the new_state portion, causing an overflowed bounds check and potentially out-of-bounds memory reads during osdmap decoding. The issue arises from a multiplication that m...

EUVD-2026-54775

In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...

CVE-2026-68082 libceph: fix two unsafe bare decodes in decode_lockers()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...

CVE-2026-68082

In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...

PT-2026-69193

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The decode lockers function in cls lock client.c contains two unsafe decode operations that allow a malicious or compromised Object Storage Device OSD to trigger slab-out-of-bounds reads...

CVE-2026-70559

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

GHSA-4VR5-P2GC-H23P rclone archive extract allows S3 destination prefix escape via crafted archive paths

Summary rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive. A malicious archive entry containing parent path components such as ../ can escape the requested extraction prefix and create or overwrite sibling objects in th...

CVE-2026-71192

In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...

The vulnerability of the endpoint AssumeRoleWithLDAPIdentity of the STS (Security Token Service) server for MinIO object storage allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the endpoint of the STS Security Token Service, which manages MinIO object storage, is related to inconsistencies in response to incoming requests. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

S3 Clones in the Neoclouds

S3 compatible services carry many of the same concerns as the original S3 service. This article highlights which assumptions break and what risks remain...

PYSEC-2026-3541 TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint

Impact The /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the TensorZero objectstorage configuration. By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that may...

TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint

ImpactThe /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the TensorZero objectstorage configuration.By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that may...

PT-2026-64141

Impact The /internal/object storage endpoint accepts a caller-supplied JSON storage path parameter that dynamically overrides the TensorZero object storage configuration. By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that ma...

GHSA-824W-X939-6CMC TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint

Impact The /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the TensorZero objectstorage configuration. By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that may...

TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint

Impact The /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the TensorZero objectstorage configuration. By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that may...