Rustfs - vulnerabilities (CVEs)

33 CVEs in 2 products, 0 in the last 30 days, newest from 2026-08-12.

Products

Rustfs - 32 CVEs
Console - 1 CVEs

Newest CVEs of Rustfs

CVE-2026-73290 - CVSS 5.3 (medium), 2026-08-12: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs…
CVE-2026-73289 - CVSS 8.1 (high), 2026-08-12: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with…
CVE-2026-73288 - CVSS 6.1 (medium), 2026-08-12: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in…
CVE-2026-73287 - CVSS 5.4 (medium), 2026-08-12: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in…
CVE-2026-73286 - CVSS 8.1 (high), 2026-08-12: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get_condition_values folds attacker-controlled request headers…
CVE-2026-73285 - CVSS 7.5 (high), 2026-08-12: RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by…
CVE-2026-73284 - CVSS 8.8 (high), 2026-08-12: RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/service_account.rs accepts an…
CVE-2026-73265 - CVSS 6.5 (medium), 2026-08-12: RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy…
CVE-2026-62378 - CVSS 9 (critical), 2026-07-15: RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console…
CVE-2026-55188 - CVSS 8.2 (high), 2026-06-26: RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket…
CVE-2026-49991 - CVSS 8.6 (high), 2026-06-26: RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can…
CVE-2026-55189 - CVSS 7.7 (high), 2026-06-26: RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe…
CVE-2026-55838 - CVSS 4.3 (medium), 2026-06-26: RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is…
CVE-2026-45043 - CVSS 9.3 (critical), 2026-05-29: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper validation in the PUT /rustfs/admin/v3/import-iam endpoint allows…
CVE-2026-46685 - CVSS 6 (medium), 2026-05-28: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFS_CORS_ALLOWED_ORIGINS is unset, the RustFS S3 listener's…
CVE-2026-47136 - CVSS 6.9 (medium), 2026-05-28: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the RustFS console endpoint GET /rustfs/console/license returns parsed…
CVE-2026-45041 - CVSS 8.7 (high), 2026-05-28: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a 2048-bit RSA private key as a string…
CVE-2026-45040 - CVSS 5.3 (medium), 2026-05-28: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive information leakage in log outputs. When the…
CVE-2026-45044 - CVSS 8.8 (high), 2026-05-28: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelists /profile/cpu and /profile/memory…
CVE-2026-45039 - CVSS 9.8 (critical), 2026-05-28: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256…
CVE-2026-45042 - CVSS 7.1 (high), 2026-05-28: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper authorization in the UploadPartCopy operation allows copying…
CVE-2026-40937 - CVSS 8.3 (high), 2026-04-22: RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in…
CVE-2026-39360 - CVSS 5.3 (medium), 2026-04-07: RustFS is a distributed object storage system built in Rust. Prior to alpha.90, RustFS contains a missing authorization check in the multipart copy path…
CVE-2026-27822 - CVSS 9.1 (critical), 2026-02-25: RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS…
CVE-2026-27607 - CVSS 9.1 (critical), 2026-02-25: RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in…
CVE-2026-24762 - CVSS 7.5 (high), 2026-02-03: RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material (access key, secret…
CVE-2026-21862 - CVSS 7.7 (high), 2026-02-03: RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts…
CVE-2026-22782 - CVSS 7.5 (high), 2026-01-16: RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the…
CVE-2026-22043 - CVSS 9.8 (critical), 2026-01-08: RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS…
CVE-2026-22042 - CVSS 8.8 (high), 2026-01-08: RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using…