CVE-2026-73285: RustFS Auth Bypass Vulnerability

CVE-2026-73285 Overview

CVE-2026-73285 is an authorization bypass vulnerability in RustFS, a distributed object storage system written in Rust. The flaw affects the external Open Policy Agent (OPA) authorization path enabled by the RUSTFS_POLICY_PLUGIN_URL configuration. In affected versions from 1.0.0-alpha.64 through 1.0.0-rc.1, the PreparedIamAuth.needs_existing_object_tag field is set incorrectly for PreparedIamMode::Opa. As a result, maybe_merge_object_tag_conditions omits s3:ExistingObjectTag/* values from authorization decisions. Authenticated users can bypass tag-based policy restrictions and access objects that should be protected. The issue is tracked under [CWE-863] and is fixed in version 1.0.0-rc.1.

Critical Impact
Authenticated users can bypass object tag-based access policies enforced through external OPA, potentially reading, modifying, or deleting objects intended to be restricted by tag conditions.

Affected Products

RustFS 1.0.0-alpha.64 through versions prior to 1.0.0-rc.1
Deployments using external OPA authorization via RUSTFS_POLICY_PLUGIN_URL
IAM policies relying on s3:ExistingObjectTag/* condition keys

Discovery Timeline

2026-08-12 - CVE-2026-73285 published to NVD
2026-08-12 - Last updated in NVD database
Fix released - RustFS v1.0.0-rc.1 release addresses the vulnerability

Technical Details for CVE-2026-73285

Vulnerability Analysis

The defect lives in the IAM preparation logic under crates/iam/src/sys.rs. RustFS builds a PreparedIamAuth structure that instructs downstream policy evaluation whether to fetch existing object tags before rendering condition keys. For the OPA mode branch, the needs_existing_object_tag flag is not set correctly. When authorization proceeds, maybe_merge_object_tag_conditions skips merging the s3:ExistingObjectTag/* values into the request context sent to the external policy engine.

OPA receives an incomplete input document. Any Rego policy that gates access based on existing object tags cannot enforce the intended rule because the tag data is absent. The evaluator falls back to whatever permissive branch remains, granting access that a tag-aware policy would have denied. The vulnerability is classified as Incorrect Authorization [CWE-863].

Root Cause

The root cause is a logic error in per-mode flag initialization. The OPA code path did not signal the need for existing object tag lookup, while the same path exists correctly for other IAM modes. This asymmetry between IAM backends produced a silent policy evaluation gap that only affects environments delegating decisions to OPA.

Attack Vector

An authenticated user with valid RustFS credentials sends S3-compatible requests targeting objects that should be restricted by tag-based OPA policies. Because the policy input lacks s3:ExistingObjectTag/* values, the OPA decision does not deny the request. The attacker gains access to protected object operations without needing to modify tags, escalate privileges, or bypass network controls.

rust

// Security patch context - crates/ecstore/src/api/mod.rs
pub mod metadata_sys {
    pub use crate::bucket::metadata_sys::{
        BucketMetadataMutationGuard, BucketMetadataSys, ObjectLockConfigState,
        acquire_bucket_metadata_transaction_lock,
        capture_bucket_metadata_incarnation, delete, delete_if_incarnation,
        get, get_accelerate_config, get_bucket_policy,
        get_bucket_policy_raw, get_bucket_targets_config, get_config_from_disk,
        get_cors_config, get_durability_config,
        get_global_bucket_metadata_sys, get_lifecycle_config, get_logging_config,
        get_notification_config,
        get_object_lock_config, get_object_lock_config_state,
        get_public_access_block_config, get_quota_config,
        get_replication_config, get_request_payment_config, get_sse_config,
        get_tagging_config, get_versioning_config,
        get_website_config, init_bucket_metadata_sys, list_bucket_targets,
        reload_bucket_metadata, remove_bucket_metadata,
        set_bucket_metadata, update, update_bucket_targets_under_transaction_lock,
        update_config_with, update_if_incarnation,
        update_under_transaction_lock,
    };
}

Source: GitHub Commit 98d3619

Detection Methods for CVE-2026-73285

Indicators of Compromise

Successful S3 object operations by authenticated users against objects whose tags should have triggered OPA denial
OPA decision logs containing input documents that lack s3:ExistingObjectTag/* fields when the target object carries tags
RustFS access logs showing GetObject, PutObject, or DeleteObject on tagged objects by principals not covered by tag-agnostic allow rules

Detection Strategies

Compare RustFS request logs against OPA decision logs to identify requests where tag-based conditions were expected but not evaluated
Enable verbose OPA input logging and alert on missing s3:ExistingObjectTag/* keys for buckets that enforce tag-based policies
Inventory RustFS deployments running versions between 1.0.0-alpha.64 and 1.0.0-rc.1 with RUSTFS_POLICY_PLUGIN_URL configured

Monitoring Recommendations

Forward RustFS audit logs and OPA decision logs to a centralized analytics platform for correlation and long-term retention
Baseline expected access patterns for tagged objects, then alert on deviations by user, bucket, or object class
Track configuration drift on the RUSTFS_POLICY_PLUGIN_URL variable and any changes to associated Rego policies

How to Mitigate CVE-2026-73285

Immediate Actions Required

Upgrade all RustFS instances to version 1.0.0-rc.1 or later
Audit recent access to objects protected by tag-based OPA policies for unauthorized reads, writes, or deletions
Rotate any credentials for principals that could have exercised the bypass and review their activity
Review OPA policies to confirm they do not silently allow requests when expected input keys are missing

Patch Information

The fix ships in RustFS v1.0.0-rc.1. The remediation is described in GHSA-5w8r-p896-6vq2 and implemented in commit 98d3619. The patch corrects the PreparedIamAuth.needs_existing_object_tag handling for PreparedIamMode::Opa so maybe_merge_object_tag_conditions includes s3:ExistingObjectTag/* values.

Workarounds

Temporarily disable external OPA authorization by unsetting RUSTFS_POLICY_PLUGIN_URL and rely on built-in IAM policies that do not depend on existing object tag conditions
Restrict authenticated user permissions so that no principal has bucket-level access without tag-aware controls, until the upgrade is applied
Add compensating deny rules in OPA that fail closed when s3:ExistingObjectTag/* input keys are missing for buckets known to require tag evaluation

bash

# Verify the running RustFS version and remediate
rustfs --version

# After upgrade, confirm binary reports 1.0.0-rc.1 or later
# Optional: temporarily disable the external OPA plugin until patched
unset RUSTFS_POLICY_PLUGIN_URL
systemctl restart rustfs