RU
Vendor
rustfs
33
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-73290 | RU rustfs rustfs | 5.3 | Aug 12 | RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback |
| CVE-2026-73289 | RU rustfs rustfs | 8.1 | Aug 12 | RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions |
| CVE-2026-73288 | RU rustfs rustfs | 6.1 | Aug 12 | RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted |
| CVE-2026-73287 | RU rustfs rustfs | 5.4 | Aug 12 | RustFS: FTPS MKD bypasses IAM CreateBucket authorization |
| CVE-2026-73286 | RU rustfs rustfs | 8.1 | Aug 12 | RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions |
| CVE-2026-73285 | RU rustfs rustfs | 7.5 | Aug 12 | RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged |
| CVE-2026-73284 | RU rustfs rustfs | 8.8 | Aug 12 | RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts |
| CVE-2026-73265 | RU rustfs rustfs | 6.5 | Aug 12 | RustFS: Version-specific object reads authorize the non-version action |
| CVE-2026-62378 | CO console rustfs | 9.0 | Jul 15 | RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover |
| CVE-2026-55188 | RU rustfs rustfs | 8.2 | Jun 26 | RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials |
| CVE-2026-49991 | RU rustfs rustfs | 8.6 | Jun 26 | RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection |
| CVE-2026-55189 | RU rustfs rustfs | 7.7 | Jun 26 | RustFS: FTP frontend skips IAM authorization on object reads |
| CVE-2026-55838 | RU rustfs rustfs | 4.3 | Jun 26 | RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics |
| CVE-2026-45043 | RU rustfs rustfs | 9.3 | May 29 | RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root |
| CVE-2026-46685 | RU rustfs rustfs | 6.0 | May 28 | RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console |
| CVE-2026-45039 | RU rustfs rustfs | 9.8 | May 28 | RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation |
| CVE-2026-45040 | RU rustfs rustfs | 5.3 | May 28 | RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode] |
| CVE-2026-45041 | RU rustfs rustfs | 8.7 | May 28 | RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery |
| CVE-2026-45042 | RU rustfs rustfs | 7.1 | May 28 | RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source |
| CVE-2026-45044 | RU rustfs rustfs | 8.8 | May 28 | RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers |
| CVE-2026-47136 | RU rustfs rustfs | 6.9 | May 28 | RustFS: Unauthenticated RustFS console license endpoint exposes license metadata |
| CVE-2026-40937 | RU rustfs rustfs | 8.3 | Apr 22 | RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks |
| CVE-2026-39360 | RU rustfs rustfs | 4.3 | Apr 7 | RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration |
| CVE-2026-27822 | RU rustfs rustfs | 5.4 | Feb 25 | Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover |
| CVE-2026-27607 | RU rustfs rustfs | 9.1 | Feb 25 | RustFS's Missing Post Policy Validation leads to Arbitrary Object Write |
| CVE-2026-24762 | RU rustfs rustfs | 7.5 | Feb 3 | RustFS Logs Sensitive Credentials in Plaintext |
| CVE-2026-21862 | RU rustfs rustfs | 7.5 | Feb 3 | RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers |
| CVE-2026-22782 | RU rustfs rustfs | 7.5 | Jan 16 | RustFS RPC signature verification logs shared secret |
| CVE-2026-22043 | RU rustfs rustfs | 9.8 | Jan 8 | RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting |
| CVE-2026-22042 | RU rustfs rustfs | 8.8 | Jan 8 | RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation |
| CVE-2025-69255 | RU rustfs rustfs | 4.0 | Jan 7 | RustFS gRPC GetMetrics deserialization panic enables remote DoS |
| CVE-2025-68705 | RU rustfs rustfs | 9.8 | Jan 7 | RustFS Path Traversal Vulnerability |
| CVE-2025-68926 | RU rustfs rustfs | 9.8 | Dec 30 | RustFS has a gRPC Hardcoded Token Authentication Bypass |