These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-73290 is a vulnerability in RustFS, a distributed object storage system built in Rust. An anonymous ListObjectVersions request can bypass public-access controls, exposing object version metadata. The issue arises from a fallback to an s3:ListBucket check, which returns before applying policy_allowed checks. This affects GET /<bucket>?versions= requests and is fixed in version 1.0.0-beta.12. Defen [truncated]
CVE-2026-73289 is a high-severity vulnerability in RustFS, a distributed object storage system built in Rust. The issue arises from incorrect evaluation of ForAllValues: and ForAnyValue: set qualifiers, potentially allowing unauthorized access or bypassing Deny conditions in policies. This problem is fixed in version 1.0.0-beta.12. Defenders managing RustFS deployments, especially those using policies bas [truncated]
CVE-2026-73288 debrief: RustFS Object Lock enforcement bypass allows unauthorized object deletion. The issue arises from RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs, which incorrectly treats ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration. This allows objects under COMPLIANCE retention to be deleted or expired. T [truncated]
CVE-2026-73287 is a vulnerability in RustFS, a distributed object storage system built in Rust. The issue allows authenticated FTPS users to create buckets without the necessary authorization, specifically the s3:CreateBucket permission. This is due to the FtpsDriver::mkd function in crates/protocols/src/ftps/driver.rs calling storage.create_bucket without proper authorization checks. The vulnerability is [truncated]
CVE-2026-73286 is a vulnerability in RustFS, a distributed object storage system built in Rust. Authenticated callers can manipulate request headers to satisfy identity-based policy conditions due to improper folding of attacker-controlled headers into server-derived condition keys. This issue is fixed in version 1.0.0-beta.12. The vulnerability allows for potential unauthorized access to sensitive data o [truncated]
CVE-2026-73285 is a high-severity vulnerability in RustFS, a distributed object storage system built in Rust. The issue allows authenticated users to bypass tag-based policy restrictions due to incorrect handling of external OPA authorization. This problem was fixed in version 1.0.0-rc.1. The vulnerability has a CVSS score of 7.5 and is considered HIGH severity. Defenders managing RustFS deployments, espe [truncated]
CVE-2026-73284 is a vulnerability in RustFS, a distributed object storage system built in Rust. The AddServiceAccount function in rustfs/src/admin/handlers/service_account.rs accepts an attacker-controlled target_user after only checking CreateServiceAccountAdminAction, passes it to new_service_account, and prepare_service_account_auth sets is_owner for the resulting root-parent service account. This issu [truncated]
CVE-2026-73265 debrief based on CVE Program and NVD records. RustFS distributed object storage system has a vulnerability allowing unauthorized disclosure of historical object content. The issue is fixed in version 1.0.0-beta.11. Affected deployments should assess exposure and prioritize upgrading to the fixed version. The vulnerability allows principals without historical-version permission to disclose k [truncated]
A critical stored cross-site scripting vulnerability exists in RustFS Console versions 0.1.7 through 0.1.10. The issue arises from the improper handling of HTML content in .pdf files, enabling an attacker to upload malicious .pdf files that can execute JavaScript code when viewed. This vulnerability, caused by a regression of CVE-2026-27822, exposes sensitive information such as administrator AccessKeyId, [truncated]
CVE-2026-49991 is a high-severity vulnerability in RustFS, a distributed object storage system built in Rust. In version 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature. This allows them to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vu [truncated]
CVE-2026-46685 documents a Cross-Origin Resource Sharing (CORS) misconfiguration in RustFS, a distributed object storage system built in Rust. The vulnerability exists in versions prior to 1.0.0-beta.2 when the RUSTFS_CORS_ALLOWED_ORIGINS environment variable is unset. In this default state, the ConditionalCorsLayer middleware reflects any request Origin header value back as Access-Control-Allow-Origin an [truncated]
CVE-2026-45044 is a HIGH severity vulnerability (CVSS 8.8) in RustFS, a distributed object storage system built in Rust. The issue affects versions prior to 1.0.0-beta.2 and was published on 2026-05-28. The vulnerability stems from an authentication bypass in the admin router, where the `/profile/cpu` and `/profile/memory` endpoints are explicitly whitelisted from authentication checks. This allows unauth [truncated]
A high-severity authorization bypass vulnerability in RustFS, a distributed object storage system built in Rust, allows unauthorized cross-bucket data movement through the UploadPartCopy operation. Prior to version 1.0.0-beta.2, the implementation validates GetObject permission on the source bucket and PutObject permission on the destination bucket independently, but fails to enforce policy constraints on [truncated]
A critical cryptographic vulnerability in RustFS distributed object storage allows complete license enforcement bypass. The application embeds a hardcoded 2048-bit RSA private key as a string constant (TEST_PRIVATE_KEY) in crates/appauth/src/token.rs, which is used in production via parse_license() to verify license tokens. Because this key is present in all published source releases and binaries, any par [truncated]
CVE-2026-45040 documents a sensitive information disclosure vulnerability in RustFS, a distributed object storage system implemented in Rust. When the server operates with RUST_LOG=debug, authentication credentials including SessionToken (JWT), SecretAccessKey, and complete JWT claims are emitted in plaintext to server logs. The vulnerability stems from improper logging practices that fail to sanitize sen [truncated]
CVE-2026-39360 is a MEDIUM severity vulnerability in RustFS, a distributed object storage system built in Rust. A missing authorization check in the multipart copy path (UploadPartCopy) allows a low-privileged user to exfiltrate victim objects by copying them into an attacker-controlled multipart upload and completing the upload. This breaks tenant isolation in multi-user / multi-tenant deployments. The v [truncated]