CVE-2026-73286: RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS getconditionvalues folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowing authenticated callers to satisfy identity-based policy conditions. This issue is fixed in version 1.0.0-beta.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.0-beta.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73286?
CVE-2026-73286 has a high severity rating of 8.1.
How do I fix CVE-2026-73286?
To fix CVE-2026-73286, upgrade to RustFS version 1.0.0-beta.12 or later.
What are the risks associated with CVE-2026-73286?
The risks include potential unauthorized access to sensitive data due to manipulated request headers.
Who is affected by CVE-2026-73286?
Users of RustFS versions prior to 1.0.0-beta.12 are affected by CVE-2026-73286.
What does CVE-2026-73286 exploit?
CVE-2026-73286 exploits the ability of attacker-controlled request headers to influence IAM condition keys, allowing policy conditions to be satisfied wrongly.