Latest vulnerabilities for vendor "rustfs"

Where

Sort:

Software

rustfs rustfs

rustfs rustfs rust

rustfs

rustfs rustfs console

rustfs snowball auto-extract

RustFS RustFSRustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions

Risk 60

Severity

8.1

First published (updated )

CVE-2026-73286

RustFS RustFS ConsoleRustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover

Risk 74

Severity

First published (updated )

CVE-2026-62378

RustFS Snowball auto-extractRustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection

Risk 49

Severity

8.6

First published (updated )

CVE-2026-49991

RustFS RustFSRustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root

Risk 64

Severity

9.3

First published (updated )

CVE-2026-45043

RustFS RustFSRustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console

Risk 42

Severity

First published (updated )

CVE-2026-46685

RustFS RustFSRustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation

Risk 86

Severity

9.8

First published (updated )

CVE-2026-45039

RustFS RustFSRustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]

Risk 26

Severity

5.3

First published (updated )

CVE-2026-45040

RustFS RustFSRustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery

Risk 47

Severity

8.7

First published (updated )

CVE-2026-45041

RustFS RustFSRustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source

Risk 40

Severity

7.1

First published (updated )

CVE-2026-45042

RustFS RustFSRustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers

Risk 57

Severity

8.8

First published (updated )

CVE-2026-45044

RustFS RustFSRustFS: Unauthenticated RustFS console license endpoint exposes license metadata

Risk 33

Severity

6.9

First published (updated )

CVE-2026-47136

RustFS Rustfs RustRustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks

Risk 69

Severity

8.3

First published (updated )

CVE-2026-40937

RustFS Rustfs RustRustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration

Risk 26

Severity

5.3

First published (updated )

CVE-2026-39360

RustFS Rustfs RustRust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

Risk 55

Severity

9.1

EPSS

0.03%

First published (updated )

CVE-2026-27822

RustFS Rustfs RustRustFS's Missing Post Policy Validation leads to Arbitrary Object Write

Risk 47

Severity

9.1

EPSS

0.09%

First published (updated )

CVE-2026-27607

RustFS Rustfs RustRustFS Logs Sensitive Credentials in Plaintext

Risk 31

Severity

7.5

EPSS

0.06%

First published (updated )

CVE-2026-24762

RustFS Rustfs RustRustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

Risk 44

Severity

7.7

First published (updated )

CVE-2026-21862

RustFS Rustfs RustRustFS RPC signature verification logs shared secret

Risk 31

Severity

7.5

EPSS

0.05%

First published (updated )

CVE-2026-22782

RustFS Rustfs RustRustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

Risk 61

Severity

9.8

EPSS

0.05%

First published (updated )

CVE-2026-22043

RustFS Rustfs RustRustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

Risk 56

Severity

8.8

EPSS

0.04%

First published (updated )

CVE-2026-22042

RustFS Rustfs RustRustFS gRPC GetMetrics deserialization panic enables remote DoS

Risk 28

Severity

5.5

First published (updated )

CVE-2025-69255

RustFS Rustfs RustRustFS Path Traversal Vulnerability

Risk 86

Severity

9.8

First published (updated )

CVE-2025-68705

RustFS Rustfs RustRustFS has a gRPC Hardcoded Token Authentication Bypass

Risk 86

Severity

9.8

First published (updated )

CVE-2025-68926

Trending

Vendor Risk Score

Software

RustFS RustFSRustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions

RustFS RustFS ConsoleRustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover

RustFS Snowball auto-extractRustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection

RustFS RustFSRustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root

RustFS RustFSRustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console

Don't miss critical vulnerabilities

RustFS RustFSRustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation

RustFS RustFSRustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]

RustFS RustFSRustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery

RustFS RustFSRustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source

RustFS RustFSRustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers

Don't miss critical vulnerabilities

RustFS RustFSRustFS: Unauthenticated RustFS console license endpoint exposes license metadata

RustFS Rustfs RustRustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks

RustFS Rustfs RustRustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration

RustFS Rustfs RustRust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

RustFS Rustfs RustRustFS's Missing Post Policy Validation leads to Arbitrary Object Write

Don't miss critical vulnerabilities

RustFS Rustfs RustRustFS Logs Sensitive Credentials in Plaintext

RustFS Rustfs RustRustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

RustFS Rustfs RustRustFS RPC signature verification logs shared secret

RustFS Rustfs RustRustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

RustFS Rustfs RustRustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

Don't miss critical vulnerabilities

RustFS Rustfs RustRustFS gRPC GetMetrics deserialization panic enables remote DoS

RustFS Rustfs RustRustFS Path Traversal Vulnerability

RustFS Rustfs RustRustFS has a gRPC Hardcoded Token Authentication Bypass

Company

Resources

Contact