CVE-2026-73265 Overview
CVE-2026-73265 is a missing authorization vulnerability in RustFS, a distributed object storage system written in Rust. The flaw affects how RustFS evaluates permissions for versioned object reads. When a client references an explicit versionId in GetObject, CopyObject sources, or UploadPartCopy sources, RustFS checks for the s3:GetObject permission rather than the required s3:GetObjectVersion permission. Principals lacking historical-version access can therefore read known historical object content. The issue is fixed in version 1.0.0-beta.11 and is tracked under [CWE-862] Missing Authorization.
Critical Impact
Authenticated users with only s3:GetObject rights can disclose historical object versions they should not be able to read, breaking S3 versioning access controls.
Affected Products
- RustFS distributed object storage releases prior to 1.0.0-beta.11
- Deployments relying on s3:GetObjectVersion to gate access to historical object versions
- Workloads issuing GetObject, CopyObject, or UploadPartCopy requests with explicit versionId parameters
Discovery Timeline
- 2026-08-12 - CVE-2026-73265 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-73265
Vulnerability Analysis
RustFS implements S3-compatible object storage with versioning support. The AWS S3 permission model separates s3:GetObject, which authorizes reads of current object content, from s3:GetObjectVersion, which authorizes reads of a specific historical version identified by versionId. RustFS conflates these two actions. When a request carries an explicit versionId, the authorization layer still evaluates the request against s3:GetObject.
Any principal granted s3:GetObject on a bucket or prefix can therefore fetch historical versions by supplying their versionId, provided that identifier is known or guessable. The same flaw applies when the versioned object is referenced as the source of a CopyObject or UploadPartCopy operation, expanding the exposure to copy-based exfiltration paths.
The advisory notes the attacker must know the target versionId. Version identifiers can leak through ListObjectVersions responses, audit logs, backups, or prior legitimate access.
Root Cause
The root cause is a missing authorization check [CWE-862]. The permission mapping in the request handler does not branch on the presence of a versionId parameter. Both current and versioned reads resolve to s3:GetObject, so IAM policies denying s3:GetObjectVersion are never consulted.
Attack Vector
Exploitation requires network access to the RustFS S3 API and valid credentials with s3:GetObject on the target bucket. The attacker issues a standard GetObject, CopyObject, or UploadPartCopy request with a known versionId and receives the historical object payload. No user interaction is required. Refer to the GitHub Security Advisory GHSA-3ppv-fx5m-m749 and the fix commit for the corrected authorization mapping.
Detection Methods for CVE-2026-73265
Indicators of Compromise
- S3 API requests to RustFS containing an explicit versionId query parameter from principals whose IAM policies exclude s3:GetObjectVersion.
- CopyObject or UploadPartCopy calls whose x-amz-copy-source header includes a versionId from unexpected principals.
- Unusual volume of ListObjectVersions requests preceding versioned reads, indicating enumeration of historical identifiers.
Detection Strategies
- Correlate RustFS access logs against IAM policy grants and flag versioned reads by principals lacking s3:GetObjectVersion.
- Baseline which service accounts legitimately consume historical versions and alert on deviations.
- Compare successful versioned reads against the object version creation timeline to surface access to objects the principal has never written or listed.
Monitoring Recommendations
- Enable verbose request logging on the RustFS gateway and forward logs to a centralized analytics platform for retention and query.
- Monitor for repeated 200 responses on GetObject calls with versionId from the same source IP or access key.
- Alert on privilege drift where policies granting s3:GetObject are added without a corresponding review of s3:GetObjectVersion.
How to Mitigate CVE-2026-73265
Immediate Actions Required
- Upgrade RustFS to version 1.0.0-beta.11 or later, which corrects the permission mapping for versioned reads.
- Audit IAM policies and remove s3:GetObject grants from principals that must not access historical versions until the upgrade is complete.
- Rotate access keys for any principal suspected of abusing the flaw and review access logs for versioned read patterns.
Patch Information
The fix is delivered in the RustFS 1.0.0-beta.11 release. The change is implemented in pull request #5142 and merged via commit 8166561, which routes versioned read requests through the s3:GetObjectVersion authorization path.
Workarounds
- Disable object versioning on buckets that do not require it, eliminating the historical content that this flaw can expose.
- Restrict s3:GetObject, CopyObject, and UploadPartCopy to trusted principals through bucket policies until the upgrade is applied.
- Front the RustFS API with a proxy that rejects requests containing a versionId parameter from unauthorized principals.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
