CVE-2026-73286 in RustFS
Summary
by MITRE • 08/12/2026
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get_condition_values folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowing authenticated callers to satisfy identity-based policy conditions. This issue is fixed in version 1.0.0-beta.12.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
RustFS represents a modern distributed object storage system implemented in the Rust programming language, designed to provide secure and scalable data storage solutions for enterprise environments. The system employs identity-based access control mechanisms that rely on policy conditions to determine authorization decisions. These conditions typically evaluate user attributes such as userid, username, principal type, group memberships, and other authentication-related metadata to enforce access policies. The vulnerability affects versions prior to 1.0.0-beta.12 where the system fails to properly sanitize or validate request headers before incorporating them into policy evaluation logic.
The technical flaw manifests in the get_condition_values function which processes HeaderMap objects containing attacker-controlled input from HTTP requests. This function indiscriminately folds various header values into server-derived condition keys without proper validation or sanitization. Specifically, attacker-controlled headers can influence critical identity attributes including userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys that are used in policy evaluation. This represents a classic case of insecure input handling where external data flows directly into security-sensitive contexts.
The operational impact of this vulnerability is significant as it allows authenticated attackers to manipulate their identity attributes within the system's authorization framework. By crafting malicious HTTP headers, an attacker can potentially bypass access controls by setting condition keys to arbitrary values that satisfy policy requirements. This could enable privilege escalation, unauthorized data access, or lateral movement within the storage environment. The vulnerability essentially undermines the integrity of the identity-based access control model by allowing attackers to fabricate their user attributes and principal identities.
This issue aligns with CWE-20, "Improper Input Validation," and CWE-79, "Cross-site Scripting," as it involves improper handling of externally controlled input that can be manipulated to influence security decisions. From an ATT&CK framework perspective, this vulnerability maps to T1566.001, "Phishing via Service Provider", and T1078, "Valid Accounts", since attackers can exploit authenticated access to manipulate their own identity attributes. The fix implemented in version 1.0.0-beta.12 likely includes proper header validation, sanitization of input values, and enforcement of strict type checking for condition keys used in policy evaluation.
Organizations deploying RustFS should immediately upgrade to version 1.0.0-beta.12 or later to mitigate this vulnerability. Additionally, security teams should conduct thorough audits of existing access policies to identify any potential exploitation that may have occurred prior to the fix. Implementing header filtering rules at network boundaries and monitoring for unusual patterns in authentication headers can provide additional defense-in-depth measures. The vulnerability serves as a reminder of the critical importance of proper input validation in security-sensitive code paths, particularly when dealing with identity and access control mechanisms in distributed systems.