CVE-2026-73290 in RustFS
Summary
by MITRE • 08/12/2026
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy_allowed path applies deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets, so a bucket that permits anonymous listing can continue exposing version listings after an operator enables the public-access control. The bypass affects GET /<bucket>?versions= and can disclose object version metadata even though equivalent GetObject requests are denied. This issue is fixed in version 1.0.0-beta.12.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in RustFS represents a critical access control flaw that undermines the security posture of distributed object storage systems. This issue specifically affects versions prior to 1.0.0-beta.12 where anonymous users could bypass intended access restrictions through a flawed policy evaluation mechanism. The vulnerability resides in the storage access control logic within rustfs/src/storage/access.rs, where the system fails to properly enforce bucket policies for version listing operations. When an anonymous ListObjectVersions request is made without explicit bucket-policy grants, the system incorrectly falls back to an s3:ListBucket check rather than properly evaluating the comprehensive policy_allowed path that should apply deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets controls.
The technical exploitation of this vulnerability occurs through GET requests to the bucket endpoint with versions parameter, allowing attackers to enumerate object version metadata even when direct GetObject operations are properly denied. This creates a situation where the system's access control enforcement becomes inconsistent, as version listing operations bypass the intended policy checks that should prevent anonymous access to sensitive metadata. The flaw essentially enables information disclosure through a path that was designed to be restricted, creating an unexpected data exposure channel that could reveal version history details including object creation timestamps, modification sequences, and potentially sensitive content patterns.
The operational impact of this vulnerability extends beyond simple information disclosure to encompass potential data leakage and privacy concerns within distributed storage environments. Attackers can exploit this bypass to gather detailed metadata about stored objects including their version histories, which may contain sensitive information about system usage patterns, content evolution, or business-critical data structures. This issue particularly affects organizations that rely on bucket-level access controls and expect consistent enforcement across all data plane operations. The vulnerability also demonstrates a fundamental flaw in the policy evaluation architecture where different operation types receive inconsistent security treatment, creating potential attack vectors that could be leveraged in combination with other weaknesses.
Security mitigations for this vulnerability require immediate upgrade to version 1.0.0-beta.12 or later where the proper policy enforcement mechanisms are restored. Organizations should conduct comprehensive audits of their bucket policies and access controls to identify any configurations that might have been exploited through this bypass. The fix addresses the core issue by ensuring that anonymous ListObjectVersions requests properly evaluate the complete policy_allowed path before making access decisions, thereby maintaining consistent security controls across all data plane operations. This vulnerability aligns with CWE-284 Access Control Issues and can be mapped to ATT&CK technique T1078 Valid Accounts for privilege escalation scenarios where attackers might use such information gathering to plan more sophisticated attacks against storage systems.
The implementation of proper access control enforcement in distributed storage systems requires careful attention to policy evaluation order and consistency across different operation types. This vulnerability demonstrates how seemingly minor inconsistencies in security logic can create significant exposure points, particularly in systems that handle sensitive data with complex access patterns. Organizations should implement continuous monitoring for similar policy evaluation flaws and ensure that all data plane operations undergo consistent access control validation regardless of the request type or authentication state. The fix implemented in version 1.0.0-beta.12 represents a necessary correction to maintain the integrity of access control mechanisms within RustFS storage systems, preventing unauthorized metadata disclosure while preserving legitimate operational functionality.