FTP Vulnerability in RustFS Object Storage System

CVE-2026-55189

What is CVE-2026-55189?

RustFS, a distributed object storage system built in Rust, suffers from a significant authorization bypass vulnerability related to its FTP frontend. In versions ranging from 1.0.0-alpha.1 to 1.0.0-beta.9, the FTP read and probe handlers bypass the necessary IAM authorization checks, allowing any user who can authenticate to the FTP listener unrestricted access to read and probe any object within any bucket, disregarding their IAM policies. This flaw poses a serious threat as it compromises the security model expected from IAM protections. The vulnerability is addressed in version 1.0.0-beta.9.

References