CVE-2026-73290 rustfs CVE debrief

Who should care

Defenders responsible for RustFS deployments, particularly those with publicly accessible buckets, should assess exposure and verify the version of RustFS in use. They should review bucket policies, upgrade to version 1.0.0-beta.12 or later if necessary, and monitor for potential exposure of object version metadata.

Why it matters

CVE-2026-73290 allows anonymous listing of object versions in RustFS, potentially disclosing metadata. Defenders should verify exposure, review bucket policies, and upgrade to version 1.0.0-beta.12 or later.

• Potential disclosure of object version metadata
• Verification of bucket policy and public-access controls required
• Upgrade to version 1.0.0-beta.12 or later necessary to fix the issue

Technical summary

The vulnerability in RustFS allows an anonymous ListObjectVersions request to bypass public-access controls, potentially disclosing object version metadata. This arises from a fallback to an s3:ListBucket check, which returns before applying policy_allowed checks. Affected deployments should verify exposure, review bucket policies, and upgrade to version 1.0.0-beta.12 or later. The issue affects GET /<bucket>?versions= requests and can disclose object version metadata even though equivalent GetObject requests are denied.

Defensive priority

Defenders should prioritize verifying exposure of object version metadata and upgrading to version 1.0.0-beta.12 or later.

Recommended defensive actions

• Verify exposure of object version metadata in RustFS deployments
• Review bucket policies and public-access controls
• Upgrade to version 1.0.0-beta.12 or later
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Affected deployments and potential exposure require verification. Defenders should check for publicly accessible buckets, review bucket policies, and verify the RustFS version in use. The scope of affected deployments and extent of potential exposure are not fully known and require further verification and defensive review.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.