CVE-2026-45042 RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source
Attackers can move data across buckets without proper policy enforcement, leading to unauthorized data access and modification in RustFS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45042?
CVE-2026-45042 is a high-severity missing authorization vulnerability in rustfs, published on 28 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper authorization in the UploadPartCopy operation allows copying objects across buckets without enforcing destination bucket restrictions on allowed copy sources. The implementation validates GetObject permission on the source bucket and PutObject on the destination bucket independently, but does not enforce any policy constraints on whether the destination bucket permits the specified copy source. This enables unauthorized cross-bucket data movement. This vulnerability is fixed in 1.0.0-beta.2.
Weakness: CWE-863
Which versions are affected by CVE-2026-45042?
How do I fix CVE-2026-45042?
No fix has been published for CVE-2026-45042 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-45042 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45042 exists.
Sources
Also known as GHSA-wfxj-ph3v-7mjf.