agentprime: rustfsEvery new CVE for rustfs.https://agentprime.io/CVE-2026-73290: RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallbackhttps://agentprime.io/advisories/CVE-2026-73290/https://agentprime.io/advisories/CVE-2026-73290/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 14:46:20 GMTCVECVE-2026-73289: RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisionshttps://agentprime.io/advisories/CVE-2026-73289/https://agentprime.io/advisories/CVE-2026-73289/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 14:43:58 GMTCVECVE-2026-73288: RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deletedhttps://agentprime.io/advisories/CVE-2026-73288/https://agentprime.io/advisories/CVE-2026-73288/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 14:42:50 GMTCVECVE-2026-73287: RustFS: FTPS MKD bypasses IAM CreateBucket authorizationhttps://agentprime.io/advisories/CVE-2026-73287/https://agentprime.io/advisories/CVE-2026-73287/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 14:41:15 GMTCVECVE-2026-73286: RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditionshttps://agentprime.io/advisories/CVE-2026-73286/https://agentprime.io/advisories/CVE-2026-73286/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 14:40:04 GMTCVECVE-2026-73285: RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untaggedhttps://agentprime.io/advisories/CVE-2026-73285/https://agentprime.io/advisories/CVE-2026-73285/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 14:37:42 GMTCVECVE-2026-73284: RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accountshttps://agentprime.io/advisories/CVE-2026-73284/https://agentprime.io/advisories/CVE-2026-73284/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 14:34:27 GMTCVECVE-2026-73265: RustFS: Version-specific object reads authorize the non-version actionhttps://agentprime.io/advisories/CVE-2026-73265/https://agentprime.io/advisories/CVE-2026-73265/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 14:33:04 GMTCVECVE-2026-55188: RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentialshttps://agentprime.io/advisories/CVE-2026-55188/https://agentprime.io/advisories/CVE-2026-55188/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 20:03:52 GMTCVECVE-2026-49991: RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injectionhttps://agentprime.io/advisories/CVE-2026-49991/https://agentprime.io/advisories/CVE-2026-49991/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 20:01:29 GMTCVECVE-2026-55189: RustFS: FTP frontend skips IAM authorization on object readshttps://agentprime.io/advisories/CVE-2026-55189/https://agentprime.io/advisories/CVE-2026-55189/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:59:13 GMTCVECVE-2026-55838: RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metricshttps://agentprime.io/advisories/CVE-2026-55838/https://agentprime.io/advisories/CVE-2026-55838/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:57:46 GMTCVECVE-2026-45043: RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Roothttps://agentprime.io/advisories/CVE-2026-45043/https://agentprime.io/advisories/CVE-2026-45043/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 12:25:08 GMTCVEcriticalCVE-2026-46685: RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on consolehttps://agentprime.io/advisories/CVE-2026-46685/https://agentprime.io/advisories/CVE-2026-46685/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 28 May 2026 18:41:35 GMTCVECVE-2026-45039: RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonationhttps://agentprime.io/advisories/CVE-2026-45039/https://agentprime.io/advisories/CVE-2026-45039/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 28 May 2026 18:39:54 GMTCVEcriticalCVE-2026-45040: RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]https://agentprime.io/advisories/CVE-2026-45040/https://agentprime.io/advisories/CVE-2026-45040/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 28 May 2026 18:35:48 GMTCVECVE-2026-45041: RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgeryhttps://agentprime.io/advisories/CVE-2026-45041/https://agentprime.io/advisories/CVE-2026-45041/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 28 May 2026 18:34:06 GMTCVECVE-2026-45042: RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Sourcehttps://agentprime.io/advisories/CVE-2026-45042/https://agentprime.io/advisories/CVE-2026-45042/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 28 May 2026 18:32:31 GMTCVECVE-2026-45044: RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlershttps://agentprime.io/advisories/CVE-2026-45044/https://agentprime.io/advisories/CVE-2026-45044/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 28 May 2026 18:31:39 GMTCVECVE-2026-47136: RustFS: Unauthenticated RustFS console license endpoint exposes license metadatahttps://agentprime.io/advisories/CVE-2026-47136/https://agentprime.io/advisories/CVE-2026-47136/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 28 May 2026 18:30:08 GMTCVE