Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

rustfs — Vulnerabilities & Security Advisories 12

All 12 CVE vulnerabilities found in rustfs, with AI-generated Chinese analysis, references, and POCs.

Vendor: rustfs

CVE IDTitleCVSSSeverityPublished
CVE-2026-40937 RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks CWE-862 8.3 High2026-04-22
CVE-2026-39360 RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration CWE-862 6.5AIMediumAI2026-04-07
CVE-2026-27822 Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover CWE-79 9.1 Critical2026-02-25
CVE-2026-27607 RustFS's Missing Post Policy Validation leads to Arbitrary Object Write CWE-20 8.1 High2026-02-25
CVE-2026-24762 RustFS Logs Sensitive Credentials in Plaintext CWE-532 6.5AIMediumAI2026-02-03
CVE-2026-21862 RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers CWE-290 9.1AICriticalAI2026-02-03
CVE-2026-22782 RustFS RPC signature verification logs shared secret CWE-532 7.5 -2026-01-16
CVE-2026-22043 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting CWE-269 8.8 -2026-01-08
CVE-2026-22042 RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation CWE-285 8.8 -2026-01-08
CVE-2025-69255 RustFS gRPC GetMetrics deserialization panic enables remote DoS CWE-755 7.5 -2026-01-07
CVE-2025-68705 RustFS Path Traversal Vulnerability CWE-22 6.5 -2026-01-07
CVE-2025-68926 RustFS has a gRPC Hardcoded Token Authentication Bypass CWE-798 9.8 Critical2025-12-30

All 12 known CVE vulnerabilities affecting rustfs with full Chinese analysis, references, and POCs where available.