RustFS up to alpha.77 Header get_condition_values X-Forwarded-For/X-Real-Ip authentication spoofing

Summaryinfo

A vulnerability was found in RustFS up to alpha.77. It has been rated as critical. This issue affects the function get_condition_values of the component Header Handler. This manipulation of the argument X-Forwarded-For/X-Real-Ip causes authentication spoofing. The identification of this vulnerability is CVE-2026-21862. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in RustFS up to alpha.77 and classified as critical. Affected by this vulnerability is the function get_condition_values of the component Header Handler. The manipulation of the argument X-Forwarded-For/X-Real-Ip with an unknown input leads to a authentication spoofing vulnerability. The CWE definition for the vulnerability is CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies. This issue has been patched in version alpha.78.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-21862 since 01/05/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

Upgrading to version alpha.78 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• RustFS

Version

• alpha.0
• alpha.1
• alpha.2
• alpha.3
• alpha.4
• alpha.5
• alpha.6
• alpha.7
• alpha.8
• alpha.9
• alpha.10
• alpha.11
• alpha.12
• alpha.13
• alpha.14
• alpha.15
• alpha.16
• alpha.17
• alpha.18
• alpha.19
• alpha.20
• alpha.21
• alpha.22
• alpha.23
• alpha.24
• alpha.25
• alpha.26
• alpha.27
• alpha.28
• alpha.29
• alpha.30
• alpha.31
• alpha.32
• alpha.33
• alpha.34
• alpha.35
• alpha.36
• alpha.37
• alpha.38
• alpha.39
• alpha.40
• alpha.41
• alpha.42
• alpha.43
• alpha.44
• alpha.45
• alpha.46
• alpha.47
• alpha.48
• alpha.49
• alpha.50
• alpha.51
• alpha.52
• alpha.53
• alpha.54
• alpha.55
• alpha.56
• alpha.57
• alpha.58
• alpha.59
• alpha.60
• alpha.61
• alpha.62
• alpha.63
• alpha.64
• alpha.65
• alpha.66
• alpha.67
• alpha.68
• alpha.69
• alpha.70
• alpha.71
• alpha.72
• alpha.73
• alpha.74
• alpha.75
• alpha.76
• alpha.77

Website

• Product: https://github.com/rustfs/rustfs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion