RustFS S3 GetObject Authorization Bypass via versionId (CVE-2026-7205)

Vulnerability Overview Title: Version-specific object reads authorize the non-version action Description: When RustFS selects the non-version action, if the S3 request explicitly provides a , the storage path is used to read the specified object version. This principle allows reading the current object when lacking permission, thereby enabling access to known historical versions. The same action selection error also affects the source logic for and . Scope Affected Versions: Fixed Version: Affected Paths: - : Authorization for , source, and source. - : Propagation of explicit version ID for both object and object version use cases. - : Precise historical version selection. - : Compatibility mapping from to , which also leads to incorrect allow/deny behavior for current object reads. Remediation Required Fixes: - Select whenever an explicit version parameter is present in conjunction with . - Apply the same policy to authorization for and sources. - Remove the to policy compatibility mapping once all callers are corrected. - Preserve request, response, storage, and public REST API formats. - and other version-aware operations require separate AWS-specific auditing and are not asserted as part of this recommendation. Required Regression Matrix: - For direct , source, and source, test scenarios involving , , both, and explicit versions. - Cover current version, , range, part number, presigned, STS/Session, service account, and anonymous bucket policy paths. - Assert that the backend reader is not invoked for each denial; successful reads must verify bytes and length. - Add a test demonstrating that version denial does not block current object requests when is absent. Disclosure Status Keep this recommendation confidential until the patch and supported versions are available. Do not copy technical details into public bug reports or unrelated pull requests. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None CVE ID: CVE-2026-7205 Weaknesses: - CWE-862 - CWE-863 Severity: Medium (6.5 / 10) Publication Date: 3 weeks ago Software: rustfs Security Boundaries and Impact: - The affected paths are S3 API operations reached after request authentication but before the object reader. - Attacker-controlled sources include the explicit query or bucket policy action selection. - The control bypassed is IAM or bucket policy action selection, with the goal being precise historical version reading. - Normal IAM users, STS/Session policies, service accounts, presigned requests, and anonymous bucket policies use the same authorization path. - The confirmed impact is unauthorized disclosure of historical object content to entities allowed but denied . - and can copy disclosed historical content to authorized buckets. - This report does not claim arbitrary anonymous access to private buckets. Summary This vulnerability involves RustFS failing to correctly validate the parameter when processing S3 requests, allowing non-version actions to read historical version objects. The scope includes versions . The remediation plan includes selecting the correct policy, removing the compatibility mapping, and conducting regression testing. The disclosure status remains confidential until the patch and supported versions are available.

Goal Reached Thanks to every supporter — we hit 100%!

RustFS S3 GetObject Authorization Bypass via versionId (CVE-2026-7205)

More from this source