CVE-2026-73287: RustFS Auth Bypass Vulnerability

CVE-2026-73287 Overview

RustFS is a distributed object storage system written in Rust. Versions prior to 1.0.0-beta.12 contain a missing authorization flaw [CWE-862] in the File Transfer Protocol Secure (FTPS) subsystem. The FtpsDriver::mkd function in crates/protocols/src/ftps/driver.rs invokes storage.create_bucket without first calling authorize_operation for the S3Action::CreateBucket action. Authenticated FTPS users explicitly denied the s3:CreateBucket permission can therefore create buckets by issuing an FTPS MKD command. The issue is fixed in version 1.0.0-beta.12.

Critical Impact
Authenticated FTPS users bypass Simple Storage Service (S3) policy denials and create arbitrary buckets, undermining tenant isolation and access-control guarantees.

Affected Products

RustFS distributed object storage, all versions prior to 1.0.0-beta.12
Deployments exposing the FTPS protocol interface
Multi-tenant RustFS environments relying on S3 policy denials for s3:CreateBucket

Discovery Timeline

2026-08-12 - CVE-2026-73287 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73287

Vulnerability Analysis

RustFS enforces S3-style access policies through an authorize_operation check that validates the caller's permission for a specific S3Action before executing storage operations. The FTPS driver bridges the FTPS protocol surface to the same storage backend, translating FTPS commands into S3 operations. The MKD (make directory) command is mapped to bucket creation.

The vulnerable code path in FtpsDriver::mkd calls storage.create_bucket directly. It never invokes the authorization layer for S3Action::CreateBucket. Any user who can authenticate to the FTPS endpoint reaches the storage backend regardless of policy configuration. Denied users therefore acquire an unintended write primitive that S3 clients would be blocked from using.

Root Cause

The root cause is a missing authorization check [CWE-862] in a protocol adapter. Authorization was implemented for the S3 HTTP interface but not consistently applied across all protocol front-ends that reach the same storage APIs. The FTPS driver assumed authentication at the transport layer was sufficient and skipped per-action policy evaluation.

Attack Vector

An attacker requires valid FTPS credentials for a RustFS user whose S3 policy denies s3:CreateBucket. The attacker connects over FTPS, authenticates, and issues an MKD command with the desired bucket name. The server creates the bucket without consulting the policy engine. This yields policy bypass and can be used to stage further activity, exhaust namespace quotas, or establish attacker-controlled storage locations within the tenant.

rust

// Patch excerpt from crates/policy/src/policy.rs
 pub use action::ActionSet;
 pub use doc::PolicyDoc;
 pub use effect::Effect;
-pub use function::Functions;
+pub use function::{Functions, is_server_derived_condition_key};
 pub use id::ID;
 pub use policy::*;
 pub use principal::Principal;
// Source: https://github.com/rustfs/rustfs/commit/92f83bfe155d8a3b9cdd903086e5b28d52339efb

The accompanying policy module hardens condition-key handling so that identity and connection keys must come from server-verified state, complementing the authorization enforcement added to the FTPS MKD path. See the GitHub Security Advisory GHSA-g3vq-vv42-f647 for the full advisory.

Detection Methods for CVE-2026-73287

Indicators of Compromise

Unexpected buckets appearing in RustFS whose creator identity maps to an FTPS-authenticated user denied s3:CreateBucket.
FTPS session logs showing MKD commands issued by principals whose S3 policy explicitly denies bucket creation.
Divergence between S3 audit logs and bucket-inventory listings, where new buckets exist without a corresponding authorized CreateBucket S3 API call.

Detection Strategies

Correlate FTPS command logs with S3 authorization decisions and alert when MKD succeeds for principals that lack s3:CreateBucket.
Baseline the set of expected buckets per tenant and alert on any bucket created outside change-managed provisioning workflows.
Inventory RustFS deployments and flag any instance running a release earlier than 1.0.0-beta.12 with the FTPS interface enabled.

Monitoring Recommendations

Enable verbose FTPS access and command logging on every RustFS node and forward the events to a centralized logging or SIEM platform.
Monitor bucket-creation events at the storage backend and reconcile them against policy-engine decisions in near real time.
Track authentication anomalies on the FTPS endpoint, including unusual source addresses and off-hours MKD activity.

How to Mitigate CVE-2026-73287

Immediate Actions Required

Upgrade all RustFS deployments to version 1.0.0-beta.12 or later, which adds the missing authorize_operation call for S3Action::CreateBucket in FtpsDriver::mkd.
Audit existing buckets for unauthorized creations by FTPS-authenticated principals and remove or quarantine any that violate policy.
Rotate FTPS credentials for users whose access may have been abused prior to patching.

Patch Information

The fix is delivered in RustFS release 1.0.0-beta.12 and implemented in the upstream commit 92f83bf. The patched build routes FTPS MKD through the same authorization layer as the S3 HTTP interface, ensuring denials of s3:CreateBucket are honored regardless of the protocol used.

Workarounds

Disable the FTPS interface on RustFS nodes if it is not required, eliminating the vulnerable code path entirely.
Restrict FTPS network exposure to trusted management ranges using firewall or security-group rules until the patch is deployed.
Remove or tightly scope FTPS-enabled user accounts so that only fully trusted principals can reach the MKD command surface.

bash

# Verify the running RustFS version and upgrade if below 1.0.0-beta.12
rustfs --version

# Example: block inbound FTPS control and data channels at the host firewall
iptables -A INPUT -p tcp --dport 21 -j DROP
iptables -A INPUT -p tcp --dport 990 -j DROP