CVE-2026-73287: RustFS: FTPS MKD bypasses IAM CreateBucket authorization
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by calling storage.createbucket without authorizeoperation for S3Action::CreateBucket, allowing authenticated FTPS users denied s3:CreateBucket to create buckets. This issue is fixed in version 1.0.0-beta.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RustFSto a version that resolves this vulnerability.Fixed in 1.0.0-beta.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73287?
The severity of CVE-2026-73287 is rated as medium with a score of 5.4.
How do I fix CVE-2026-73287?
To fix CVE-2026-73287, update RustFS to version 1.0.0-beta.12 or later, which addresses the authorization bypass.
What impact does CVE-2026-73287 have on my system?
CVE-2026-73287 allows authenticated FTPS users to bypass IAM permissions for bucket creation, potentially leading to unauthorized access.
Who is affected by CVE-2026-73287?
Users of RustFS versions prior to 1.0.0-beta.12 who utilize FTPS MKD functionality are affected by CVE-2026-73287.
What is RustFS related to CVE-2026-73287?
RustFS is a distributed object storage system built in Rust that has a vulnerability allowing unauthorized bucket creation through FTPS MKD.