Medium severity · published Aug 12, 2026
CVE-2026-73288
RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired. This issue is fixed in version 1.0.0-rc.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
rustfs · rustfs
< 1.0.0-rc.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73288
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73288
github.com
https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d
github.com
https://github.com/rustfs/rustfs/pull/5648
github.com
https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1
github.com
https://github.com/rustfs/rustfs/security/advisories/GHSA-j548-9grx-fh4f
More from rustfs
9.8
CVE-2026-45039
RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation
9.8
CVE-2026-22043
RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
9.8
CVE-2025-68705
RustFS Path Traversal Vulnerability
9.8
CVE-2025-68926
RustFS has a gRPC Hardcoded Token Authentication Bypass
9.3
CVE-2026-45043
RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root