Log in Start free

rustfs

Products

ProductCVEsExploitedLatest
rustfs32–Aug 12, 2026
console1–Jul 15, 2026

Exploited and recent CVEs

  • CVE-2026-73290 Medium 5.3 RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback 0.4%
  • CVE-2026-73289 High 8.1 RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions 0.4%
  • CVE-2026-73288 Medium 6.1 RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted 0.4%
  • CVE-2026-73287 Medium 5.4 RustFS: FTPS MKD bypasses IAM CreateBucket authorization 0.4%
  • CVE-2026-73286 High 8.1 RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions 0.4%
  • CVE-2026-73285 High 7.5 RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged 0.5%
  • CVE-2026-73284 High 8.8 RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts 0.5%
  • CVE-2026-73265 Medium 6.5 RustFS: Version-specific object reads authorize the non-version action 0.4%
  • CVE-2026-62378 Critical 9.0 RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover 0.4%
  • CVE-2026-55188 High 8.2 RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials 0.3%
  • CVE-2026-49991 High 8.6 RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection 0.4%
  • CVE-2026-55189 High 7.7 RustFS: FTP frontend skips IAM authorization on object reads 0.3%
  • CVE-2026-55838 Medium 4.3 RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics 0.3%
  • CVE-2026-45043 Critical 9.3 RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root 0.2%
  • CVE-2026-46685 Medium 6.0 RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console 0.1%
  • CVE-2026-45039 Critical 9.8 RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation 0.3%
  • CVE-2026-45040 Medium 5.3 RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode] 0.2%
  • CVE-2026-45041 High 8.7 RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery 0.2%
  • CVE-2026-45042 High 7.1 RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source 0.2%
  • CVE-2026-45044 High 8.8 RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers 0.3%
  • CVE-2026-47136 Medium 6.9 RustFS: Unauthenticated RustFS console license endpoint exposes license metadata 0.3%
  • CVE-2026-40937 High 8.3 RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks 0.3%
  • CVE-2026-39360 Medium 5.3 RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration 0.2%
  • CVE-2026-27822 Critical 9.1 Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover 5.1%
  • CVE-2026-27607 High 8.1 RustFS's Missing Post Policy Validation leads to Arbitrary Object Write 0.4%
  • CVE-2026-24762 Medium 6.9 RustFS Logs Sensitive Credentials in Plaintext 0.3%
  • CVE-2026-21862 High 7.7 RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers 0.3%
  • CVE-2026-22782 Low 2.9 RustFS RPC signature verification logs shared secret 0.5%
  • CVE-2026-22043 Medium 5.7 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting 0.4%
  • CVE-2026-22042 Medium 5.7 RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation 0.4%