CVE-2026-73289: RustFS Auth Bypass Vulnerability

CVE-2026-73289 Overview

CVE-2026-73289 is an authorization flaw in RustFS, a distributed object storage system written in Rust. Versions prior to 1.0.0-beta.12 incorrectly evaluate the ForAllValues: and ForAnyValue: set qualifiers when combined with negated string operators. The affected operators include StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike. The result is that Allow conditions can grant access to excluded principals and Deny guardrails can fail to block prohibited actions. Policies referencing jwt:groups and jwt:roles are directly impacted, and absent condition keys receive inverted qualifier behavior. The issue is classified under CWE-863: Incorrect Authorization.

Critical Impact
Attackers with valid low-privilege credentials can bypass identity-based access policies to read or modify object storage data protected by negated policy conditions.

Affected Products

RustFS versions prior to 1.0.0-beta.12
Deployments relying on ForAllValues: or ForAnyValue: qualifiers with negated string or ARN operators
Policies evaluating jwt:groups and jwt:roles condition keys

Discovery Timeline

2026-08-12 - CVE-2026-73289 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73289

Vulnerability Analysis

RustFS implements AWS-style Identity and Access Management (IAM) policy evaluation in the crates/policy/src/policy/function/string.rs module. The policy engine supports set qualifiers ForAllValues: and ForAnyValue: that determine how a condition operator applies to multi-valued request keys such as jwt:groups.

For negated operators like StringNotEquals, the correct semantics require negation of each per-value predicate before the quantifier aggregates results. The vulnerable implementation instead evaluates the positive form across the value set and negates the aggregate result. This inversion causes ForAllValues:StringNotEquals to behave like ForAnyValue:StringNotEquals and vice versa.

The consequence is that partially overlapping policy and request value sets produce incorrect authorization decisions. Absent condition keys also invert their vacuous-truth behavior, further widening the impact on both Allow and Deny statements.

Root Cause

The defect is a logic error in the quantifier and negation ordering within the policy evaluation function. Negation was applied to eval or eval_like output after quantification rather than to each request-value predicate before quantification.

Attack Vector

An authenticated user whose JWT contains group or role claims that partially overlap with a policy's excluded set can obtain access that policy authors intended to deny. Conversely, Deny policies constructed with the same qualifiers may fail to block prohibited principals.

rust

// Patch excerpt from crates/policy/src/policy/function.rs
// Source: https://github.com/rustfs/rustfs/commit/92f83bfe155d8a3b9cdd903086e5b28d52339efb

/// Set qualifier applied to a condition key that carries multiple request values.
///
/// The distinction matters for negated operators (`StringNotEquals`, `StringNotLike`,
/// `ArnNotEquals`, `ArnNotLike`, ...). For those, negation must be applied to each
/// request value *before* the quantifier aggregates them; negating the aggregate
/// instead turns `ForAllValues` into `ForAnyValue` and vice versa.
#[derive(Clone, Copy, Default, Debug, PartialEq, Eq)]
pub enum Quantifier {
    #[default]
    None,
    /// `ForAnyValue:` — satisfied when at least one request value satisfies the operator.
    /// Unsatisfiable when the key is absent from the request.
    ForAnyValue,
    /// `ForAllValues:` — satisfied when every request value satisfies the operator.
    /// Vacuously satisfied when the key is absent from the request.
    ForAllValues,
}

Detection Methods for CVE-2026-73289

Indicators of Compromise

Successful S3-compatible API requests from principals whose JWT groups or roles claims should have been excluded by policy conditions
Access to buckets or objects governed by policies containing ForAllValues:StringNotEquals, ForAnyValue:StringNotLike, ArnNotEquals, or ArnNotLike operators
Unexpected authorization decisions logged for principals with partially overlapping group memberships

Detection Strategies

Audit deployed RustFS policies for any statement combining ForAllValues: or ForAnyValue: qualifiers with negated operators, and replay representative requests against a patched build to compare decisions
Enable RustFS access logging and correlate authorization decisions with the identity claims presented in each request
Inventory RustFS instances by version and flag any release prior to 1.0.0-beta.12

Monitoring Recommendations

Forward RustFS request and audit logs to a centralized analytics platform for continuous review of access patterns
Alert on privileged object operations such as s3:DeleteObject, s3:PutBucketPolicy, and s3:GetObject on sensitive buckets when initiated by non-administrative principals
Track policy version changes and evaluate them against a test harness that exercises negated set qualifiers

How to Mitigate CVE-2026-73289

Immediate Actions Required

Upgrade all RustFS deployments to version 1.0.0-beta.12 or later
Review policies that rely on ForAllValues: or ForAnyValue: with negated operators and validate their intended behavior on the patched build
Rotate credentials for principals whose JWT claims overlap with excluded groups or roles in existing policies

Patch Information

The fix is included in the RustFS 1.0.0-beta.12 release. The corrective changes introduce an explicit Quantifier enum and apply negation per request value before quantifier aggregation. See the upstream commit 92f83bf and the GHSA-v9cp-qfw9-9pfp advisory for details.

Workarounds

Rewrite affected policies to avoid negated operators inside ForAllValues: or ForAnyValue: qualifiers, using explicit positive StringEquals or StringLike matches where feasible
Restrict issuance of JWTs containing multi-valued groups or roles claims until the upgrade is deployed
Apply network-level restrictions to limit access to RustFS management and data endpoints to trusted principals only

bash

# Verify the running RustFS version and upgrade if below 1.0.0-beta.12
rustfs --version

# Example: pull the patched release container image
docker pull rustfs/rustfs:1.0.0-beta.12

# Restart the service after upgrading
systemctl restart rustfs