CVE-2026-73286: RustFS Auth Bypass Vulnerability

CVE-2026-73286 Overview

RustFS is a distributed object storage system written in Rust. Versions prior to 1.0.0-beta.12 contain an authorization flaw in the get_condition_values function. The function folds attacker-controlled HTTP request headers from HeaderMap into server-derived identity condition keys, including userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap:. Authenticated callers can inject these headers to satisfy identity-based policy conditions they should not meet. The issue is tracked as CWE-863: Incorrect Authorization and fixed in version 1.0.0-beta.12.

Critical Impact
Authenticated users can forge identity condition values via HTTP headers to bypass IAM policy checks and gain unauthorized access to objects and administrative actions.

Affected Products

RustFS distributed object storage — all versions prior to 1.0.0-beta.12
Deployments relying on IAM policies with identity-based condition keys
Multi-tenant RustFS clusters exposing S3-compatible APIs to authenticated users

Discovery Timeline

2026-08-12 - CVE-2026-73286 published to NVD
2026-08-12 - Last updated in NVD database
Fix released - RustFS 1.0.0-beta.12 with GHSA-6r96-hmgc-726c

Technical Details for CVE-2026-73286

Vulnerability Analysis

RustFS evaluates IAM-style policies by building a map of condition key-value pairs from the incoming request. The get_condition_values routine in the policy crate assembles this map from multiple sources, including the HTTP HeaderMap. The vulnerable implementation does not distinguish between keys that must originate from server-verified authentication state and keys that may accept request input.

As a result, an authenticated caller can add HTTP headers matching well-known identity condition keys. When policy evaluation runs, those attacker-supplied values populate slots such as userid, username, principaltype, groups, and namespaced prefixes like jwt: and ldap:. Policies conditioned on identity attributes then match values the client controls rather than values derived from the authenticated session.

Root Cause

The root cause is missing server-derived key enforcement during condition map construction. The patch introduces an is_server_derived_condition_key helper and a KeyName::is_server_derived check that mark identity and connection keys as off-limits to request input. The condition assembler now refuses request-supplied values for those keys, ensuring policy evaluation uses only server-verified state.

Attack Vector

Exploitation requires authenticated access to the RustFS API but no elevated privileges. The attacker sends a normal S3-style request and appends HTTP headers whose names collide with identity condition keys. Because the network attack vector requires only low privileges and no user interaction, any tenant on a shared cluster can attempt bypass against policies that gate access by user, group, or federation attribute.

rust

// Patch: crates/policy/src/policy/function.rs
// Adds server-derived key check and quantifier semantics
pub mod number;
pub mod string;

/// Set qualifier applied to a condition key that carries multiple request values.
#[derive(Clone, Copy, Default, Debug, PartialEq, Eq)]
pub enum Quantifier {
    #[default]
    None,
    /// `ForAnyValue:` — satisfied when at least one request value satisfies the operator.
    ForAnyValue,
    /// `ForAllValues:` — satisfied when every request value satisfies the operator.
    ForAllValues,
}

/// Whether `name` is one of the well-known keys whose value must come from
/// server-verified state rather than from request input.
pub fn is_server_derived_condition_key(name: &str) -> bool {

Source: GitHub commit 92f83bf

rust

// Patch: crates/policy/src/policy.rs
// Re-exports the new server-derived condition key predicate
pub use action::ActionSet;
pub use doc::PolicyDoc;
pub use effect::Effect;
-pub use function::Functions;
+pub use function::{Functions, is_server_derived_condition_key};
pub use id::ID;
pub use policy::*;
pub use principal::Principal;

Source: GitHub commit 92f83bf

Detection Methods for CVE-2026-73286

Indicators of Compromise

Inbound HTTP requests carrying headers with names matching identity condition keys such as userid, username, principaltype, groups, versionid, signatureversion, or headers prefixed with jwt: and ldap:.
Access grants to objects or admin actions where the authenticated principal does not match the effective policy subject.
Audit log entries showing successful policy matches against principals that differ from the session's authenticated user.

Detection Strategies

Enable verbose policy evaluation logging on RustFS nodes and correlate matched condition keys against expected identity sources.
Deploy a reverse proxy or WAF rule to strip or reject requests containing reserved condition-key header names before they reach RustFS.
Compare object access telemetry with directory or IdP records to flag principals accessing resources outside their group memberships.

Monitoring Recommendations

Ingest RustFS access and audit logs into a centralized analytics platform and alert on header names overlapping with identity keys.
Track version drift across the RustFS fleet to confirm all nodes run 1.0.0-beta.12 or later.
Baseline per-tenant API request patterns and alert on sudden expansion of accessed prefixes or buckets.

How to Mitigate CVE-2026-73286

Immediate Actions Required

Upgrade all RustFS instances to 1.0.0-beta.12 or later.
Rotate credentials for any accounts that could have been used to test the bypass on unpatched clusters.
Review IAM policies that rely on identity condition keys and validate recent access decisions against IdP records.

Patch Information

The fix is delivered in RustFS 1.0.0-beta.12 via commit 92f83bf. The patch adds is_server_derived_condition_key, introduces explicit Quantifier semantics for ForAllValues: and ForAnyValue: prefixes, and rejects request-supplied values for server-derived identity keys during condition map assembly. Details are in GHSA-6r96-hmgc-726c.

Workarounds

Place RustFS behind a proxy that removes headers matching reserved identity condition key names before forwarding requests.
Restrict API access to trusted networks and enforce mutual TLS until the upgrade completes.
Temporarily rewrite IAM policies to remove reliance on identity condition keys, using resource ARNs and principal ARNs only.

bash

# Example NGINX rule to strip reserved identity condition-key headers
location / {
    proxy_set_header userid "";
    proxy_set_header username "";
    proxy_set_header principaltype "";
    proxy_set_header groups "";
    proxy_set_header versionid "";
    proxy_set_header signatureversion "";
    # Strip namespaced jwt: and ldap: headers via a map + more_clear_input_headers
    proxy_pass http://rustfs_backend;
}