CVE-2026-73288: RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/objectlock/objectlocksys.rs lets checkobjectlockfordeletion, deleteprefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired. This issue is fixed in version 1.0.0-rc.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RustFSto a version that resolves this vulnerability.Fixed in 1.0.0-rc.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73288?
The severity of CVE-2026-73288 is rated at 50.
How do I fix CVE-2026-73288?
To fix CVE-2026-73288, upgrade RustFS to version 1.0.0-rc.1 or later.
What impact does CVE-2026-73288 have on object retention?
CVE-2026-73288 allows for the deletion of retained objects if bucket metadata cannot be read.
Which software is affected by CVE-2026-73288?
CVE-2026-73288 affects the RustFS distributed object storage system.
When was CVE-2026-73288 published?
CVE-2026-73288 was published on August 12, 2026.