CVE-2026-73285

HIGH 7.5

RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs_existing_object_tag incorrectly for PreparedIamMode::Opa, causing maybe_merge_object_tag_conditions to omit s3:ExistingObjectTag/* values and allowing authenticated users to bypass tag-based policy restrictions. This issue is fixed in version 1.0.0-rc.1.

CWE	CWE-863
Vendor	rustfs
Product	rustfs
Published	Aug 12, 2026
Last Updated	Aug 12, 2026

Stay Ahead of the Next One

Get instant alerts for rustfs rustfs

Be the first to know when new high vulnerabilities affecting rustfs rustfs are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

rustfs / rustfs

>= 1.0.0-alpha.64, < 1.0.0-rc.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rustfs/rustfs/security/advisories/GHSA-5w8r-p896-6vq2 github.com: https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d github.com: https://github.com/rustfs/rustfs/blob/380ed40b471887014fe21d069b61df9eacca074b/.agents/skills/security-advisory-lessons/references/advisory-patterns.md?plain=1#L47 github.com: https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1