Missing Authorization Check in RustFS Distributed Object Storage
CVE-2026-39360

5.3MEDIUM

Key Information:

Vendor

Rustfs

Status
Rustfs
Vendor
CVE Published:
7 April 2026

What is CVE-2026-39360?

RustFS, a distributed object storage system developed in Rust, has a vulnerability that allows low-privileged users to bypass proper authorization checks in the multipart copy function (UploadPartCopy). This loophole enables these users to exfiltrate data from victim buckets even if they lack the necessary permissions to access that data. By copying victim objects into a multipart upload controlled by the attacker, the trust barrier of tenant isolation is compromised in multi-user and multi-tenant environments. The issue has been rectified in version alpha.90.

Affected Version(s)

rustfs < alpha.90

References

https://github.com/rustfs/rustfs/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.