CVE-2026-73289 rustfs CVE debrief

Who should care

Defenders managing RustFS deployments, especially those using policies based on jwt:groups and jwt:roles, should assess their exposure and verify the version of RustFS they are using. This vulnerability could potentially allow unauthorized access or bypass security controls.

Why it matters

CVE-2026-73289 is a high-severity vulnerability in RustFS that affects the evaluation of policy qualifiers, potentially leading to unauthorized access or bypassing of security controls. Defenders should prioritize verifying their RustFS deployments and assessing the impact of this vulnerability.

• Potential unauthorized access to restricted resources
• Bypassing of Deny conditions in policies
• Incorrect policy enforcement for jwt:groups and jwt:roles
• Need for verification of RustFS version and policy configurations

Technical summary

The vulnerability in RustFS arises from incorrect evaluation of ForAllValues: and ForAnyValue: set qualifiers. This occurs because the negation of aggregate results is performed after evaluation instead of negating each request-value predicate before quantification. As a result, partially overlapping policy and request value sets can lead to incorrect access grants or Deny condition failures. This issue affects policies based on jwt:groups and jwt:roles, and can also result in opposite behavior for absent keys.

Defensive priority

Defenders should prioritize verifying their RustFS deployments, especially those using policies based on jwt:groups and jwt:roles, and assess the impact of this vulnerability on their systems.

Recommended defensive actions

• Verify RustFS version and update to 1.0.0-beta.12 or later if necessary
• Review policies using jwt:groups and jwt:roles for potential vulnerabilities
• Assess the impact of this vulnerability on your RustFS deployments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is confirmed in RustFS versions prior to 1.0.0-beta.12. The issue is related to incorrect negation of aggregate results in policy evaluation. Official references are available from the CVE Program and NVD.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.