Vulnerability · Published Feb 25, 2026 · Assigned by GitHub_M

CVE-2026-27607RustFS's Missing Post Policy Validation leads to Arbitrary Object Write

High 8.1

In plain English

A high-severity improper input validation in rustfs from rustfs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 69.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enables unauthorized file uploads exceeding size limits, uploads to arbitrary object keys, and content-type spoofing, potentially leading to storage exhaustion, unauthorized data access, and security bypasses. Version 1.0.0-alpha.83 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
rustfs	rustfs	>= 1.0.0-alpha.56, < 1.0.0-alpha.83

Weakness: CWE-20, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

https://github.com/rustfs/rustfs/security/advisories/GHSA-w5fh-f8xh-5x3p x_refsource_CONFIRM