CVE-2026-40937: falha de alta gravidade em rustfs
RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.3epss 0.3%
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rustfs/src/admin/handlers/event.rs` use a `check_permissions` helper that validates authentication only (access key + session token), without performing any admin-action authorization via `validate_admin_request`. Every other admin handler in the codebase correctly calls `validate_admin_request` with a specific `AdminAction`. This is the only admin handler file that skips authorization. A non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attacker-controlled endpoint. This enables cross-user event interception and audit evasion. 1.0.0-alpha.94 contains a patch.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Produtos afetados
rustfs · rustfsCVEs relacionadas — rustfs
No mesmo produto, das mais perigosas para as menos.
CVE-2025-68926CRITICALRustFS has a gRPC Hardcoded Token Authentication BypassEPSS 31.9%CVE-2025-68705HIGHRustFS Path Traversal VulnerabilityEPSS 7.3%CVE-2026-27822CRITICALRust has Critical Stored XSS in Preview Modal, leading to Administrative Account TakeoverEPSS 5.1%CVE-2026-22782LOWRustFS RPC signature verification logs shared secretEPSS 0.5%CVE-2026-73284HIGHRustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service AccountsEPSS 0.5%CVE-2026-73285HIGHRustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untaggedEPSS 0.5%