CVE-2026-73285 in RustFS
Summary
by MITRE • 08/12/2026
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs_existing_object_tag incorrectly for PreparedIamMode::Opa, causing maybe_merge_object_tag_conditions to omit s3:ExistingObjectTag/* values and allowing authenticated users to bypass tag-based policy restrictions. This issue is fixed in version 1.0.0-rc.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability resides within RustFS, a distributed object storage system implemented in Rust, specifically affecting versions from 1.0.0-alpha.64 through 1.0.0-rc.1. This security flaw impacts the system's external Open Policy Agent OPA authorization mechanism that is activated when the RUSTFS_POLICY_PLUGIN_URL environment variable is configured. The issue manifests in the crates/iam/src/sys.rs file where the PreparedIamAuth.needs_existing_object_tag field is incorrectly set for the PreparedIamMode::Opa enumeration value. This misconfiguration directly affects the authorization decision process by causing the maybe_merge_object_tag_conditions function to omit crucial s3:ExistingObjectTag/* policy conditions from evaluation.
The technical flaw represents a classic authorization bypass vulnerability that stems from improper state management within the IAM authorization system. When PreparedIamMode::Opa is active, the system should correctly identify when object tag conditions are required for policy evaluation, but instead it incorrectly flags these conditions as unnecessary. This misclassification leads to the omission of s3:ExistingObjectTag/* values during policy enforcement, effectively removing crucial access controls that depend on existing object tags. The vulnerability is classified under CWE-284 Access Control Bypass, where insufficient authorization checks allow unauthorized access to protected resources.
The operational impact of this vulnerability is significant for systems relying on tag-based access control within RustFS. Authenticated users who should be restricted from accessing certain objects based on their existing tags can bypass these restrictions entirely. This creates a scenario where malicious actors or improperly configured legitimate users can access objects that should be protected by tag-based policies, potentially leading to data exposure or unauthorized modifications. The consequences extend beyond simple access violations as tag-based policies often serve as critical controls for compliance requirements and data governance frameworks.
The mitigation strategy involves upgrading to version 1.0.0-rc.1 where the bug has been resolved through proper initialization of the PreparedIamAuth.needs_existing_object_tag field for OPA mode operations. Organizations should also implement comprehensive monitoring of authorization decisions to detect potential bypass attempts, while reviewing existing tag-based policies to ensure they remain effective. The fix aligns with ATT&CK technique T1078 Valid Accounts by addressing a mechanism that allows unauthorized access through legitimate authentication channels. System administrators should verify that all environments using external OPA authorization are updated and revalidate their current policy configurations to prevent exploitation of this authorization bypass vulnerability.