CVE-2026-21862 RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers
Attackers can bypass IP-based access controls in RustFS by spoofing X-Forwarded-For headers, allowing unauthorized access to resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-21862?
CVE-2026-21862 is a high-severity authentication bypass vulnerability in rustfs, published on 3 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies. This issue has been patched in version alpha.78.
Weakness: CWE-290
Which versions are affected by CVE-2026-21862?
2 open source packages ship an affected version, including rustfs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rustfs crates.io | All versions | 1.0.0-alpha.78 |
rustfs crates.io | All versions | 1.0.0-alpha.78 |
Products include Rustfs Rustfs.
How do I fix CVE-2026-21862?
Upgrade rustfs to 1.0.0-alpha.78 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-21862 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-21862 exists.
Other vulnerabilities in rustfs
- CVE-2025-68926 RustFS has a gRPC Hardcoded Token Authentication Bypass
- CVE-2026-27822 Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover
- CVE-2025-68705 RustFS Path Traversal Vulnerability
- CVE-2026-40937 RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
- CVE-2026-27607 RustFS's Missing Post Policy Validation leads to Arbitrary Object Write
Sources
Also known as GHSA-fc6g-2gcp-2qrq.