CVE-2026-22042 RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation
Attackers with export-only permissions can import IAM data to modify users and policies, leading to privilege escalation in RustFS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22042?
CVE-2026-22042 is a medium-severity missing authorization vulnerability in rustfs, published on 8 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAction` instead of `ImportIAMAction`, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation. Version 1.0.0-alpha.79 fixes the issue.
Which versions are affected by CVE-2026-22042?
2 open source packages ship an affected version, including rustfs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rustfs crates.io | All versions | 1.0.0-alpha.79 |
rustfs crates.io | All versions | 1.0.0-alpha.79 |
Products include Rustfs Rustfs.
How do I fix CVE-2026-22042?
Upgrade rustfs to 1.0.0-alpha.79 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-22042 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22042 exists.
Other vulnerabilities in rustfs
- CVE-2025-68926 RustFS has a gRPC Hardcoded Token Authentication Bypass
- CVE-2026-27822 Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover
- CVE-2025-68705 RustFS Path Traversal Vulnerability
- CVE-2026-40937 RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
- CVE-2026-27607 RustFS's Missing Post Policy Validation leads to Arbitrary Object Write
Sources
Also known as GHSA-vcwh-pff9-64cc.