CVE-2026-73284 RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts
An attacker with admin privileges can create root-parent service accounts, leading to privilege escalation and potential full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73284?
CVE-2026-73284 is a high-severity vulnerability in rustfs, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/service_account.rs accepts an attacker-controlled target_user after only checking CreateServiceAccountAdminAction, passes it to new_service_account, and prepare_service_account_auth sets is_owner for the resulting root-parent service account. This issue is fixed in version 1.0.0-beta.11.
Weakness: CWE-269
Which versions are affected by CVE-2026-73284?
How do I fix CVE-2026-73284?
No fix has been published for CVE-2026-73284 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-73284 being exploited?
There is no known exploitation of CVE-2026-73284 in the wild and no public exploit code.
Sources
Also known as GHSA-5354-r3w2-34m8.