CVE-2026-73285 rustfs CVE debrief

Who should care

Defenders managing RustFS deployments, especially those using external OPA authorization, should assess their exposure and verify their system versions. They should also review and update OPA authorization configurations to prevent potential unauthorized access. Additionally, defenders should monitor for unusual activity in RustFS deployments and verify RustFS deployment versions to ensure 1.0.0-rc.1 or later is running.

Why it matters

CVE-2026-73285 is a high-severity vulnerability in RustFS that allows authenticated users to bypass tag-based policy restrictions. Defenders managing RustFS deployments should verify their system versions and OPA configurations to prevent potential unauthorized access.

• Authenticated users may bypass tag-based policy restrictions
• Potential for unauthorized access to sensitive data
• Need to verify RustFS deployment versions and OPA configurations
• Possible impact on data integrity and confidentiality

Technical summary

The vulnerability in RustFS allows authenticated users to bypass tag-based policy restrictions due to incorrect handling of external OPA authorization. This issue was fixed in version 1.0.0-rc.1. The vulnerability has a CVSS score of 7.5 and is considered HIGH severity. The incorrect handling of external OPA authorization sets PreparedIamAuth.needs_existing_object_tag incorrectly for PreparedIamMode::Opa, causing maybe_merge_object_tag_conditions to omit s3:ExistingObjectTag/* values. This could lead to unauthorized access to sensitive data.

Defensive priority

Defenders should prioritize verifying their RustFS deployments, especially those using external OPA authorization, and ensure they are running version 1.0.0-rc.1 or later.

Recommended defensive actions

• Verify RustFS deployment versions and ensure 1.0.0-rc.1 or later is running
• Review and update OPA authorization configurations
• Monitor for unusual activity in RustFS deployments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, its impact, and the fix. However, additional information about potential exploitation or affected systems is limited. Defenders should verify RustFS deployment versions and OPA configurations to prevent potential unauthorized access. The vulnerability allows authenticated users to bypass tag-based policy restrictions, which could lead to unauthorized access to sensitive data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.