CVE-2026-22043
published 2026-01-08CVE-2026-22043: RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.38%
29.6th percentile
RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions. Version 1.0.0-alpha.79 fixes the issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rustfs | rustfs | — | — |
| rustfs | rustfs | — | — |
| rustfs | rustfs | >= 0 < 1.0.0-alpha.98 | 1.0.0-alpha.98 |
| rustfs | rustfs | 0 – 0.0.2 | — |
| rustfs | rustfs | >= 1.0.0-alpha.13 < 1.0.0-alpha.79 | 1.0.0-alpha.79 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor RustFS deployments running versions 1.0.0-alpha.13 through 1.0.0-alpha.78 for anomalous service account creation activity, especially where the resulting account has broader permissions than the originating credential. ↗
- →Alert on privilege escalation patterns where session/inline policy restrictions are bypassed — a newly issued service account inheriting parent's full privileges despite the parent being restricted is a strong indicator of exploitation. ↗
- ·The vulnerability exists specifically in the IAM deny_only short-circuit logic; patched in version 1.0.0-alpha.79. Environments not yet upgraded remain fully exposed. ↗
- ·A public exploit is reported to exist for this CVE, raising the urgency of detection and patching. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.7MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa8.1HIGH
osv8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover
ghsa·2026-05-05
CVE-2026-22042 [HIGH] CWE-863 RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover
RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover
## Summary
`ListServiceAccount` (`GET /rustfs/admin/v3/list-service-accounts?user=`) authorizes cross-user requests against `UpdateServiceAccountAdminAction` instead of `ListServiceAccountsAdminAction` at `rustfs/src/admin/handlers/service_account.rs:936`. The handler accepts the **wrong** admin action and rejects the **correct** one:
- A user granted only `admin:UpdateServiceAccount` enumerates every service account in the cluster, including the root user's (HTTP 200, full metadata).
- A user granted only `admin:ListServiceAccounts` — the permission name every IAM document treats as "list service accounts" — receives HTTP 403 AccessDenied on the same reque
GHSA
RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
ghsa·2026-04-22
CVE-2026-40937 [HIGH] CWE-862 RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
# Missing Admin Auth on Notification Target Endpoints in RustFS
### Finding Summary
All four notification target admin API endpoints in `rustfs/src/admin/handlers/event.rs` use a `check_permissions` helper that validates authentication only (access key + session token), without performing any admin-action authorization via `validate_admin_request`. Every other admin handler in the codebase correctly calls `validate_admin_request` with a specific `AdminAction`. This is the only admin handler file that skips authorization.
A non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attack
GHSA
RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
ghsa·2026-01-08·CVSS 8.1
CVE-2026-22043 [HIGH] CWE-269 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
## Summary
A flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions.
## Details
**akin to MinIO CVE-2025-62506**
- Policy evaluation: `Policy::is_allowed` returns true when `deny_only=true` if no explicit Deny is hit, skipping all Allow checks (`crates/policy/src/policy/policy.rs:66-74`).
- Service account creation path sets `deny_only=true` when the target user equals the caller or its parent (`rustfs/src/admin/handlers/service_account.rs:114-127`).
- Service accounts are
OSV
RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
osv·2026-01-08·CVSS 8.1
CVE-2026-22043 [HIGH] RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
## Summary
A flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions.
## Details
**akin to MinIO CVE-2025-62506**
- Policy evaluation: `Policy::is_allowed` returns true when `deny_only=true` if no explicit Deny is hit, skipping all Allow checks (`crates/policy/src/policy/policy.rs:66-74`).
- Service account creation path sets `deny_only=true` when the target user equals the caller or its parent (`rustfs/src/admin/handlers/service_account.rs:114-127`).
- Service accounts are
No detection rules found.
No public exploits indexed.
2026-01-08
Published