CVE-2026-21862: RustFS Auth Bypass Vulnerability

CVE-2026-21862 Overview

CVE-2026-21862 is an authentication bypass vulnerability in RustFS, a distributed object storage system built in Rust. Prior to version alpha.78, the IP-based access control mechanism can be bypassed because the get_condition_values function trusts client-supplied X-Forwarded-For and X-Real-Ip headers without verifying a trusted proxy. This allows any reachable client to spoof the aws:SourceIp value and satisfy IP-allowlist policies, effectively circumventing access controls.

Critical Impact

Attackers can bypass IP-based access control restrictions by spoofing trusted headers, potentially gaining unauthorized access to protected object storage resources.

Affected Products

• RustFS versions prior to alpha.78

Discovery Timeline

• 2026-02-03 - CVE CVE-2026-21862 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-21862

Vulnerability Analysis

This vulnerability falls under CWE-290 (Authentication Bypass by Spoofing), where the application accepts security-critical information from an untrusted source without proper verification. The RustFS storage system implements IP-based access control policies that rely on the aws:SourceIp condition to restrict access to specific IP addresses or ranges. However, the get_condition_values function responsible for extracting client IP information improperly trusts the X-Forwarded-For and X-Real-Ip HTTP headers without validating whether the request originates from a trusted proxy.

In typical deployment scenarios, these headers are set by reverse proxies or load balancers to preserve the original client IP address. However, when the application directly accepts these headers from any client without proxy verification, attackers can craft requests with arbitrary IP addresses in these headers, effectively impersonating trusted IP addresses that would normally be allowed by the access control policy.

Root Cause

The root cause lies in the get_condition_values function which extracts IP address information from HTTP headers. The function fails to implement a trusted proxy verification mechanism, meaning it accepts X-Forwarded-For and X-Real-Ip header values from any source. Without a whitelist of trusted proxy addresses or proper header chain validation, the application cannot distinguish between legitimate proxy-forwarded headers and attacker-spoofed headers.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to the RustFS service can exploit this vulnerability by:

1. Identifying IP addresses or ranges that are allowed by the target's access control policy
2. Crafting HTTP requests with X-Forwarded-For or X-Real-Ip headers set to an allowed IP address
3. Sending these requests directly to the RustFS service
4. The get_condition_values function extracts the spoofed IP from the headers
5. The access control evaluation uses the spoofed IP, matching the allowlist policy
6. The attacker gains unauthorized access to protected resources

The exploitation is straightforward as it only requires adding HTTP headers to requests. No complex exploit code is necessary—standard HTTP clients or tools like curl can add the required headers to bypass IP-based restrictions.

Detection Methods for CVE-2026-21862

Indicators of Compromise

• Requests containing X-Forwarded-For or X-Real-Ip headers that did not originate from known proxy servers
• Access logs showing successful requests from IP addresses that should be blocked by policy but contain spoofed headers
• Unusual access patterns to protected resources from unexpected network sources
• Multiple requests with varying X-Forwarded-For values from the same actual source IP

Detection Strategies

• Implement logging that captures both the actual connection IP and any X-Forwarded-For/X-Real-Ip header values for comparison
• Monitor for requests where the header-claimed IP differs significantly from the actual source IP
• Deploy network-level monitoring to detect direct connections to RustFS that bypass expected proxy infrastructure
• Create alerts for access to sensitive resources that include suspicious IP-spoofing headers

Monitoring Recommendations

• Enable detailed access logging in RustFS including all relevant HTTP headers
• Correlate RustFS access logs with reverse proxy or load balancer logs to identify inconsistencies
• Monitor for reconnaissance activity such as enumeration attempts from unusual sources
• Establish baseline patterns for legitimate IP addresses accessing protected resources

How to Mitigate CVE-2026-21862

Immediate Actions Required

• Upgrade RustFS to version alpha.78 or later immediately
• Review access logs for any suspicious activity that may indicate prior exploitation
• Audit current IP-based access control policies to understand exposure
• Consider implementing additional authentication mechanisms beyond IP-based controls

Patch Information

The vulnerability has been patched in RustFS version alpha.78. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Deploy RustFS behind a reverse proxy that strips or sanitizes X-Forwarded-For and X-Real-Ip headers from untrusted sources
• Implement network-level access controls (firewall rules, security groups) to restrict access to trusted networks
• Add authentication requirements beyond IP-based controls for sensitive resources
• If direct client connections are not expected, configure network infrastructure to only allow connections from known proxy servers

# Example nginx configuration to sanitize forwarded headers
# Only trust X-Forwarded-For from known proxy addresses
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
real_ip_header X-Forwarded-For;
real_ip_recursive on;