EUVD-2026-1471

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed denyonly short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privilege...

CVE-2026-22043 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed denyonly short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privilege...

CVE-2026-22043

Summary: CVE-2026-22043 affects RustFS versions 1.0.0-alpha.13 to 1.0.0-alpha.78. A flawed deny_only short-circuit in the RustFS IAM subsystem allows a restricted service account or STS credential to mint an unrestricted service account, inheriting the parent’s full privileges and enabling privil...