CVE-2026-22043

Critical

Published: 08/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

In RustFS versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions. Version 1.0.0-alpha.79 fixes the issue.

Risk Assessment

Restricted accounts can gain full privileges, potentially leading to unauthorized data access and system integrity compromise.

Recommendation

Upgrade RustFS to version 1.0.0-alpha.79 or later as soon as possible.

Original NVD description (English source)

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions. Version 1.0.0-alpha.79 fixes the issue.