Vulnerability · Published Aug 12, 2026 · Assigned by GitHub_M

CVE-2026-73288RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted

Medium 6.1

In plain English

A medium-severity security flaw in rustfs from rustfs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 4.0)6.1Medium

Exploit odds (30 days)0.4%top 66.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired. This issue is fixed in version 1.0.0-rc.1.

Affected products (as reported)

Vendor	Product	Versions
rustfs	rustfs	< 1.0.0-rc.1

Weakness: CWE-693, CWE-754 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/rustfs/rustfs/security/advisories/GHSA-j548-9grx-fh4f x_refsource_CONFIRM
https://github.com/rustfs/rustfs/pull/5648 x_refsource_MISC
https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d x_refsource_MISC
https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1 x_refsource_MISC