RustFS: Unauthenticated RustFS console license endpoint exposes license metadata

RustFS: Version-specific object reads authorize the non-version action

RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted

RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console

RustFS: FTPS MKD bypasses IAM CreateBucket authorization

Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback

RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]

RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics

RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration

RustFS gRPC GetMetrics deserialization panic enables remote DoS