CVE-2026-73290: RustFS Auth Bypass Vulnerability

CVE-2026-73290 Overview

CVE-2026-73290 is an authorization bypass vulnerability in RustFS, a distributed object storage system written in Rust. The flaw resides in rustfs/src/storage/access.rs and affects the anonymous ListObjectVersions request path. When a request lacks a direct bucket-policy grant, the code falls back to an s3:ListBucket check and returns before the policy_allowed path applies deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets. As a result, a bucket that permits anonymous listing can continue exposing version listings even after an operator enables the public-access control. The issue is fixed in version 1.0.0-beta.12.

Critical Impact
An unauthenticated remote attacker can enumerate object version metadata via GET /<bucket>?versions= even when equivalent GetObject requests are denied and public-access restrictions are enabled.

Affected Products

RustFS distributed object storage prior to 1.0.0-beta.12
Deployments relying on RestrictPublicBuckets to block anonymous access
Buckets that previously permitted anonymous s3:ListBucket

Discovery Timeline

2026-08-12 - CVE-2026-73290 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73290

Vulnerability Analysis

The vulnerability is an Incorrect Authorization flaw [CWE-863] in the RustFS access-control pipeline. When RustFS evaluates an anonymous ListObjectVersions request, it first checks for a direct bucket-policy grant. When that grant is missing, the code falls back to an s3:ListBucket evaluation and returns early with an allow decision. The early return bypasses subsequent enforcement logic responsible for honoring the public-access controls that operators rely on to lock down previously public buckets.

The practical impact is disclosure of object version metadata through GET /<bucket>?versions=. Because version listings often include historical object names, version IDs, timestamps, and delete markers, they can reveal deleted or superseded content that operators intended to conceal. Notably, the bypass diverges from the GetObject path, which correctly denies anonymous reads under the same policy configuration, giving operators a false sense that public-access restrictions are effective.

Root Cause

The root cause is an ordering defect in rustfs/src/storage/access.rs. The s3:ListBucket fallback returns its decision before policy_allowed applies deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets. Deny logic that should override the legacy anonymous-listing behavior is never reached.

Attack Vector

The attack requires no authentication, no user interaction, and only network reachability to the RustFS endpoint. An attacker issues an HTTP GET against /<bucket>?versions= and receives the version listing when the bucket historically allowed anonymous listing, regardless of newly enabled public-access controls.

rust

// Patch excerpt from crates/policy/src/policy.rs
 pub use action::ActionSet;
 pub use doc::PolicyDoc;
 pub use effect::Effect;
-pub use function::Functions;
+pub use function::{Functions, is_server_derived_condition_key};
 pub use id::ID;
 pub use policy::*;
 pub use principal::Principal;

The patch introduces is_server_derived_condition_key, distinguishing condition keys whose values must originate from server-verified state rather than request input. The companion change in crates/policy/src/policy/function.rs adds an explicit Quantifier enum (None, ForAnyValue, ForAllValues) so that negated operators such as StringNotEquals and ArnNotEquals apply negation per request value before quantifier aggregation. This prevents policy evaluation from silently inverting ForAllValues and ForAnyValue semantics on the deny path.

Source: GitHub Commit 92f83bf

Detection Methods for CVE-2026-73290

Indicators of Compromise

Unauthenticated HTTP GET requests targeting /<bucket>?versions= from external or unexpected source addresses.
Successful 200 OK responses to anonymous ListObjectVersions calls on buckets configured with RestrictPublicBuckets.
Divergent access decisions where GetObject is denied for anonymous callers but ListObjectVersions succeeds on the same bucket.

Detection Strategies

Parse RustFS access logs for the ?versions= query parameter combined with missing or anonymous principal identifiers.
Correlate policy configuration state (RestrictPublicBuckets enabled) with allow decisions on ListObjectVersions to surface enforcement gaps.
Baseline the volume of ListObjectVersions calls per bucket and alert on sudden enumeration bursts from a single source.

Monitoring Recommendations

Ingest RustFS request logs into a centralized analytics pipeline and normalize anonymous vs. authenticated principals.
Alert on any anonymous access to buckets whose policy indicates they should be private.
Track version-listing response sizes to detect large-scale metadata scraping.

How to Mitigate CVE-2026-73290

Immediate Actions Required

Upgrade all RustFS instances to version 1.0.0-beta.12 or later.
Audit bucket policies for any grant of s3:ListBucket to anonymous principals and remove the grant where unnecessary.
Rotate or invalidate any object version identifiers that may have been exposed through anonymous listings.

Patch Information

The fix is included in the RustFS 1.0.0-beta.12 release. Full technical background is documented in GitHub Security Advisory GHSA-x298-9x87-fvjq and the corrective changes appear in commit 92f83bf.

Workarounds

Remove anonymous s3:ListBucket grants from bucket policies until the upgrade is applied.
Restrict network access to the RustFS API to trusted client ranges via firewall or reverse-proxy ACLs.
Disable object versioning on buckets that do not require version history to shrink the exposed metadata surface.

bash

# Example: remove anonymous ListBucket grant using an S3-compatible client
aws --endpoint-url https://rustfs.example.internal \
    s3api put-bucket-policy \
    --bucket my-bucket \
    --policy file://restricted-policy.json

# Verify no anonymous principal remains
aws --endpoint-url https://rustfs.example.internal \
    s3api get-bucket-policy --bucket my-bucket