rustfs vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202632

Newest CVEs

• CVE-2026-73290

  RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback

  rustfs · rustfs

  Medium5.3
• CVE-2026-73289

  RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions

  rustfs · rustfs

  High8.1
• CVE-2026-73288

  RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted

  rustfs · rustfs

  Medium6.1
• CVE-2026-73287

  RustFS: FTPS MKD bypasses IAM CreateBucket authorization

  rustfs · rustfs

  Medium5.4
• CVE-2026-73286

  RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions

  rustfs · rustfs

  High8.1
• CVE-2026-73285

  RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged

  rustfs · rustfs

  High7.5
• CVE-2026-73284

  RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts

  rustfs · rustfs

  High8.8
• CVE-2026-73265

  RustFS: Version-specific object reads authorize the non-version action

  rustfs · rustfs

  Medium6.5
• CVE-2026-62378

  RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover

  rustfs · console

  Critical9.0
• CVE-2026-55188

  RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials

  rustfs · rustfs

  High8.2