Insufficient Authorization in RustFS Object Storage System
CVE-2026-40937

8.3HIGH

Key Information:

Vendor

Rustfs

Status
Rustfs
Vendor
CVE Published:
22 April 2026

What is CVE-2026-40937?

The RustFS distributed object storage system features a significant vulnerability in its admin API endpoints prior to version 1.0.0-alpha.94. The affected endpoints only validate authentication details (access key and session token) but do not enforce proper admin-action authorization using the 'validate_admin_request' method. This oversight allows non-admin users to overwrite a shared notification target, potentially routing bucket events to an attacker-controlled endpoint. Such exploitation can lead to unauthorized event interception and evade audit trails, compromising system security. A fix has been implemented in version 1.0.0-alpha.94.

Affected Version(s)

rustfs < 1.0.0-alpha.94

References

https://github.com/rustfs/rustfs/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.94
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.