CVE-2026-73288
RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired. This issue is fixed in version 1.0.0-rc.1.
| CWE | CWE-693 CWE-754 |
| Vendor | rustfs |
| Product | rustfs |
| Published | Aug 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for rustfs rustfs
Be the first to know when new unknown vulnerabilities affecting rustfs rustfs are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
rustfs / rustfs
< 1.0.0-rc.1
References
github.com: https://github.com/rustfs/rustfs/security/advisories/GHSA-j548-9grx-fh4f github.com: https://github.com/rustfs/rustfs/pull/5648 github.com: https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d github.com: https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1