CVE-2026-73290

RustFS prior to 1.0.0-beta.12 contains an anonymous ListObjectVersions bypass where a ListBucket check is used if no bucket-policy grant exists, skipping the policy_allowed path (deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets). This allows buckets that permit anonymous listin...