High severity · published May 28, 2026
CVE-2026-45042
RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper authorization in the UploadPartCopy operation allows copying objects across buckets without enforcing destination bucket restrictions on allowed copy sources. The implementation validates GetObject permission on the source bucket and PutObject on the destination bucket independently, but does not enforce any policy constraints on whether the destination bucket permits the specified copy source. This enables unauthorized cross-bucket data movement. This vulnerability is fixed in 1.0.0-beta.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
rustfs · rustfs
< 1.0.0-beta.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45042
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45042
github.com
https://github.com/rustfs/rustfs/security/advisories/GHSA-wfxj-ph3v-7mjf
More from rustfs
9.8
CVE-2026-45039
RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation
9.8
CVE-2026-22043
RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
9.8
CVE-2025-68705
RustFS Path Traversal Vulnerability
9.8
CVE-2025-68926
RustFS has a gRPC Hardcoded Token Authentication Bypass
9.3
CVE-2026-45043
RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root