Rustfs

This hub aggregates every CVE we track for Rustfs, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Rustfs.

• CVE-2026-55188RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials8.2Jun 26, 2026
• CVE-2026-49991RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection8.6Jun 26, 2026
• CVE-2026-55189RustFS: FTP frontend skips IAM authorization on object reads7.7Jun 26, 2026
• CVE-2026-55838RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics4.3Jun 26, 2026
• CVE-2026-45039RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation9.8May 28, 2026
• CVE-2026-40937RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks8.3Apr 22, 2026
• CVE-2026-39360RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration4.3Apr 7, 2026
• CVE-2026-27822Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover9.0Feb 25, 2026
• CVE-2026-27607RustFS's Missing Post Policy Validation leads to Arbitrary Object Write8.1Feb 25, 2026
• CVE-2026-24762RustFS Logs Sensitive Credentials in Plaintext7.5Feb 3, 2026
• CVE-2026-21862RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers7.5Feb 3, 2026
• CVE-2026-22782RustFS RPC signature verification logs shared secret7.5Jan 16, 2026
• CVE-2026-22043RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting9.8Jan 8, 2026
• CVE-2026-22042RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation8.8Jan 8, 2026
• CVE-2025-69255RustFS gRPC GetMetrics deserialization panic enables remote DoS4.0Jan 7, 2026