CVE-2026-73290 RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback
Attackers can bypass public access restrictions to list object versions in RustFS buckets, exposing metadata despite configured deny rules.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73290?
CVE-2026-73290 is a medium-severity missing authorization vulnerability in rustfs, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy_allowed path applies deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets, so a bucket that permits anonymous listing can continue exposing version listings after an operator enables the public-access control. The bypass affects GET /<bucket>?versions= and can disclose object version metadata even though equivalent GetObject requests are denied. This issue is fixed in version 1.0.0-beta.12.
Weakness: CWE-863
Which versions are affected by CVE-2026-73290?
How do I fix CVE-2026-73290?
No fix has been published for CVE-2026-73290 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-73290 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73290 exists.
Sources
Also known as GHSA-x298-9x87-fvjq.