CVE-2026-73284: RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts
RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/serviceaccount.rs accepts an attacker-controlled targetuser after only checking CreateServiceAccountAdminAction, passes it to newserviceaccount, and prepareserviceaccountauth sets isowner for the resulting root-parent service account. This issue is fixed in version 1.0.0-beta.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.0-beta.11
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73284?
The severity of CVE-2026-73284 is rated high, with a score of 8.8.
How do I fix CVE-2026-73284?
To fix CVE-2026-73284, you should update to the latest version of RustFS that includes the patch for this vulnerability.
What vulnerabilities does CVE-2026-73284 exploit?
CVE-2026-73284 exploits improper validation in the AddServiceAccount handler, allowing attackers to create root-parent service accounts.
What software is affected by CVE-2026-73284?
CVE-2026-73284 affects the RustFS distributed object storage system.
What impact does CVE-2026-73284 have on security?
CVE-2026-73284 can lead to unauthorized creation of privileged service accounts, posing a significant security risk.