CVE-2026-73288 rustfs CVE debrief

Who should care

RustFS users and administrators should assess exposure and upgrade priority. They should verify RustFS versions, review object lock configurations, and update security controls as necessary. Security teams and vulnerability management teams should also review the issue and plan for mitigations or updates. Additionally, operators and platform administrators may need to assess the impact on their deployments and plan accordingly.

Why it matters

CVE-2026-73288 allows unauthorized object deletion in RustFS versions before 1.0.0-rc.1 due to Object Lock enforcement bypass. RustFS users and administrators should verify exposure, assess upgrade priority, and review security controls.

• Verify object lock configurations to prevent unauthorized deletion
• Assess upgrade priority to 1.0.0-rc.1 or later
• Review and update security controls for RustFS deployments

Technical summary

RustFS Object Lock enforcement issue in versions before 1.0.0-rc.1 allows unauthorized deletion of objects under COMPLIANCE retention due to incorrect handling of ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata. This issue is fixed in version 1.0.0-rc.1. Users should verify exposure and apply the update or review security controls accordingly. The vulnerability impacts RustFS deployments, and users should assess upgrade priority based on their specific configurations and security needs. Technical details are based on official CVE and NVD records, as well as GitHub references.

Defensive priority

Medium priority for RustFS users; verify and apply 1.0.0-rc.1

Recommended defensive actions

• Verify RustFS version and assess exposure
• Apply 1.0.0-rc.1 or later if vulnerable
• Review object lock configurations
• Assess upgrade priority to 1.0.0-rc.1 or later
• Review and update security controls for RustFS deployments
• Verify object lock configurations to prevent unauthorized deletion
• Track exceptions and retest remediated assets

Evidence notes

Official CVE and NVD records provide details on the RustFS Object Lock issue. GitHub references also offer insights into the vulnerability. Evidence is limited to publicly available records, and defenders should verify the information within the constraints of available data. The issue's scope and severity are based on the information provided by these sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.