Vulnerabilities in rustfs

33 results
Vexday analysis

O rustfs apresenta 25 vulnerabilidades catalogadas, com 5 classificadas como críticas, mas nenhuma sob ataque ativo conhecido até o momento. A preocupação maior é a velocidade de divulgação recente: 13 vulnerabilidades nos últimos 90 dias, indicando descoberta ativa ou correção de problemas latentes. A fraqueza dominante (CWE-862, autorização inadequada) sugere falhas estruturais de controle de acesso que demandam revisão arquitetural.

CVE-2026-27822CRITICALRust has Critical Stored XSS in Preview Modal, leading to Administrative Account TakeoverEPSS 0.4%CVE-2026-73287MEDIUMRustFS: FTPS MKD bypasses IAM CreateBucket authorizationEPSS 0.4%CVE-2026-45043CRITICALRustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including RootEPSS 0.4%CVE-2026-45042HIGHRustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy SourceEPSS 0.4%CVE-2026-55189HIGHRustFS: FTP frontend skips IAM authorization on object readsEPSS 0.3%CVE-2025-69255MEDIUMRustFS gRPC GetMetrics deserialization panic enables remote DoSEPSS 0.3%CVE-2026-55188HIGHRustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentialsEPSS 0.3%CVE-2026-39360MEDIUMRustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltrationEPSS 0.3%CVE-2026-55838MEDIUMRustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metricsEPSS 0.3%CVE-2026-24762MEDIUMRustFS Logs Sensitive Credentials in PlaintextEPSS 0.3%CVE-2026-45040MEDIUMRustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]EPSS 0.2%CVE-2026-21862HIGHRustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headersEPSS 0.2%CVE-2026-46685MEDIUMRustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on consoleEPSS 0.1%