# rustfs.

Every CVE that names rustfs among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback](https://agentprime.io/advisories/CVE-2026-73290.md)
  `CVE-2026-73290` · CVE record: rustfs rustfs · CVSS 5.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions](https://agentprime.io/advisories/CVE-2026-73289.md)
  `CVE-2026-73289` · CVE record: rustfs rustfs · CVSS 8.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted](https://agentprime.io/advisories/CVE-2026-73288.md)
  `CVE-2026-73288` · CVE record: rustfs rustfs · CVSS 6.1 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-693, CWE-754
- [RustFS: FTPS MKD bypasses IAM CreateBucket authorization](https://agentprime.io/advisories/CVE-2026-73287.md)
  `CVE-2026-73287` · CVE record: rustfs rustfs · CVSS 5.4 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions](https://agentprime.io/advisories/CVE-2026-73286.md)
  `CVE-2026-73286` · CVE record: rustfs rustfs · CVSS 8.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged](https://agentprime.io/advisories/CVE-2026-73285.md)
  `CVE-2026-73285` · CVE record: rustfs rustfs · CVSS 7.5 High · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts](https://agentprime.io/advisories/CVE-2026-73284.md)
  `CVE-2026-73284` · CVE record: rustfs rustfs · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [RustFS: Version-specific object reads authorize the non-version action](https://agentprime.io/advisories/CVE-2026-73265.md)
  `CVE-2026-73265` · CVE record: rustfs rustfs · CVSS 6.5 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials](https://agentprime.io/advisories/CVE-2026-55188.md)
  `CVE-2026-55188` · CVE record: rustfs rustfs · CVSS 8.2 High · Not analysed yet · Published 26 Jun 2026 · Tags: Information disclosure, Hard-coded credentials, Broken access control
- [RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection](https://agentprime.io/advisories/CVE-2026-49991.md)
  `CVE-2026-49991` · CVE record: rustfs rustfs · CVSS 8.6 High · Not analysed yet · Published 26 Jun 2026 · Tags: Path traversal, Broken access control
- [RustFS: FTP frontend skips IAM authorization on object reads](https://agentprime.io/advisories/CVE-2026-55189.md)
  `CVE-2026-55189` · CVE record: rustfs rustfs · CVSS 7.7 High · Not analysed yet · Published 26 Jun 2026 · Tags: Broken access control
- [RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics](https://agentprime.io/advisories/CVE-2026-55838.md)
  `CVE-2026-55838` · CVE record: rustfs rustfs · CVSS 4.3 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Broken access control
- [RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root](https://agentprime.io/advisories/CVE-2026-45043.md)
  `CVE-2026-45043` · CVE record: rustfs rustfs · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Privilege escalation, Broken access control
- [RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console](https://agentprime.io/advisories/CVE-2026-46685.md)
  `CVE-2026-46685` · CVE record: rustfs rustfs · CVSS 6.0 Medium · Not analysed yet · Published 28 May 2026 · Tags: Authentication bypass, CWE-346, CWE-942
- [RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation](https://agentprime.io/advisories/CVE-2026-45039.md)
  `CVE-2026-45039` · CVE record: rustfs rustfs · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Hard-coded credentials, CWE-1392
- [RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs \[Debug Mode\]](https://agentprime.io/advisories/CVE-2026-45040.md)
  `CVE-2026-45040` · CVE record: rustfs rustfs · CVSS 5.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: Information disclosure
- [RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery](https://agentprime.io/advisories/CVE-2026-45041.md)
  `CVE-2026-45041` · CVE record: rustfs rustfs · CVSS 8.7 High · Not analysed yet · Published 28 May 2026 · Tags: Hard-coded credentials
- [RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source](https://agentprime.io/advisories/CVE-2026-45042.md)
  `CVE-2026-45042` · CVE record: rustfs rustfs · CVSS 7.1 High · Not analysed yet · Published 28 May 2026 · Tags: Broken access control
- [RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers](https://agentprime.io/advisories/CVE-2026-45044.md)
  `CVE-2026-45044` · CVE record: rustfs rustfs · CVSS 8.8 High · Not analysed yet · Published 28 May 2026 · Tags: Authentication bypass
- [RustFS: Unauthenticated RustFS console license endpoint exposes license metadata](https://agentprime.io/advisories/CVE-2026-47136.md)
  `CVE-2026-47136` · CVE record: rustfs rustfs · CVSS 6.9 Medium · Not analysed yet · Published 28 May 2026 · Tags: Information disclosure, Authentication bypass

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=rustfs>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/rustfs/>. Everything for agents: <https://agentprime.io/llms.txt>.