CVE-2026-22042
HighSummary
RustFS before version 1.0.0-alpha.79 has a vulnerability in the ImportIam admin API that incorrectly validates permissions using ExportIAMAction instead of ImportIAMAction. This allows a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation. Version 1.0.0-alpha.79 fixes the issue.
Risk Assessment
Risk of privilege escalation and unauthorized modification of IAM configuration, potentially leading to system takeover.
Recommendation
Update RustFS to version 1.0.0-alpha.79 or later to fix the vulnerability.
Other vulnerabilities in RustFS
See all- CVE-2026-73290Medium
In RustFS prior to 1.0.0-beta.12, an anonymous ListObjectVersions request that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy_allowed path applies deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets. This allows a bucket that permits anonymous listing to continue exposing version listings after an operator enables public-access control.
- CVE-2026-73289High
RustFS before version 1.0.0-beta.12 has incorrect evaluation of ForAllValues: and ForAnyValue: qualifiers with negated string operators, potentially granting access to excluded principals or making Deny rules ineffective.
- CVE-2026-73286High
RustFS before version 1.0.0-beta.12 has a vulnerability where get_condition_values folds attacker-controlled request headers into identity-based condition keys such as userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap:. This allows authenticated callers to satisfy identity-based policy conditions.
- CVE-2026-73285High
RustFS from version 1.0.0-alpha.64 until 1.0.0-rc.1, when external OPA authorization is enabled via RUSTFS_POLICY_PLUGIN_URL, sets PreparedIamAuth.needs_existing_object_tag incorrectly for PreparedIamMode::Opa, causing maybe_merge_object_tag_conditions to omit s3:ExistingObjectTag/* values. This allows authenticated users to bypass tag-based policy restrictions.
- CVE-2026-45043Critical
In RustFS prior to version 1.0.0-beta.2, a vulnerability exists in the PUT /rustfs/admin/v3/import-iam endpoint. Improper validation allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). An attacker can set their own credentials, leading to privilege escalation to full administrative access.
- CVE-2026-22043Critical
In RustFS versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions. Version 1.0.0-alpha.79 fixes the issue.
- CVE-2025-68705Critical
RustFS versions 1.0.0-alpha.13 to 1.0.0-alpha.78 contain a path traversal vulnerability in the /rustfs/rpc/read_file_stream endpoint. This has been patched in version 1.0.0-alpha.79.
- CVE-2025-68926Critical
RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.
- CVE-2026-73288Medium
In RustFS prior to 1.0.0-rc.1, Object Lock enforcement lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired.
- CVE-2026-73287Medium
In RustFS prior to 1.0.0-beta.12, FTPS MKD handling in FtpsDriver::mkd calls storage.create_bucket without authorize_operation for S3Action::CreateBucket, allowing authenticated FTPS users denied s3:CreateBucket to create buckets.
Original NVD description (English source)
RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAction` instead of `ImportIAMAction`, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation. Version 1.0.0-alpha.79 fixes the issue.