rustfs.

RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback

• rustfs
• Broken access control

RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions

• rustfs
• Broken access control

RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted

• rustfs
• CWE-693
• CWE-754

RustFS: FTPS MKD bypasses IAM CreateBucket authorization

• rustfs
• Broken access control

RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions

• rustfs
• Broken access control

RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged

• rustfs
• Broken access control

RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts

• rustfs
• Privilege escalation

RustFS: Version-specific object reads authorize the non-version action

• rustfs
• Broken access control

RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials

• rustfs
• Information disclosure
• Hard-coded credentials

RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection

• rustfs
• Path traversal
• Broken access control

RustFS: FTP frontend skips IAM authorization on object reads

• rustfs
• Broken access control

RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics

• rustfs
• Broken access control

RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root

• rustfs
• Privilege escalation
• Broken access control

RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console

• rustfs
• Authentication bypass
• CWE-346

RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation

• rustfs
• Hard-coded credentials
• CWE-1392

RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]

• rustfs
• Information disclosure

RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery

• rustfs
• Hard-coded credentials

RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source

• rustfs
• Broken access control

RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers

• rustfs
• Authentication bypass

RustFS: Unauthenticated RustFS console license endpoint exposes license metadata

• rustfs
• Information disclosure
• Authentication bypass