CVE-2026-46685: RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFSCORSALLOWEDORIGINS is unset, the RustFS S3 listener's ConditionalCorsLayer reflects any request Origin value back as Access-Control-Allow-Origin and also sets Access-Control-Allow-Credentials: true and Access-Control-Allow-Headers: on responses, including preflight responses and error responses. This creates a permissive cross-domain policy with untrusted origins. A browser visiting an attacker-controlled page can issue credentialed cross-origin requests to a reachable RustFS deployment and read the response when the victim browser has ambient credentials for the RustFS origin, such as saved HTTP Basic Auth credentials, reverse-proxy SSO cookies, or TLS client certificates. This vulnerability is fixed in 1.0.0-beta.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RustFSto a version that resolves this vulnerability.Fixed in 1.0.0-beta.2 - Configuration
Set RUSTFS_CORS_ALLOWED_ORIGINS to an explicit whitelist of trusted origins (for example, https://example.com) so the listener does not reflect arbitrary Origin values. Do not leave this variable unset.
RustFS S3 listener (ConditionalCorsLayer) RUSTFS_CORS_ALLOWED_ORIGINS = trusted origin(s) (do not leave unset) - Compensating control
Until the deployment is upgraded, restrict network access to the RustFS S3 listener and console (including the license metadata endpoint) to trusted IPs/networks via firewall, reverse proxy, or WAF rules to prevent untrusted cross-origin or unauthenticated access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46685?
The severity of CVE-2026-46685 is rated at 65, indicating a medium risk level.
How do I fix CVE-2026-46685?
To fix CVE-2026-46685, ensure that the RUSTFS_CORS_ALLOWED_ORIGINS environment variable is properly set to limit allowed origins.
What systems are affected by CVE-2026-46685?
CVE-2026-46685 affects RustFS versions prior to 1.0.0-beta.2.
What are the implications of CVE-2026-46685?
CVE-2026-46685 allows for reflective CORS with credentials which can lead to unauthorized access to sensitive license metadata.
Is authentication required to exploit CVE-2026-46685?
CVE-2026-46685 can be exploited without authentication, exposing the endpoint to unauthenticated users.