RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts

RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers

RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery

RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection

RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks

RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials

RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions

RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions

RustFS: FTP frontend skips IAM authorization on object reads

RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged

RustFS Logs Sensitive Credentials in Plaintext

RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

RustFS RPC signature verification logs shared secret

RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source