CVE-2026-73290

MEDIUM 5.3

RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy_allowed path applies deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets, so a bucket that permits anonymous listing can continue exposing version listings after an operator enables the public-access control. The bypass affects GET /<bucket>?versions= and can disclose object version metadata even though equivalent GetObject requests are denied. This issue is fixed in version 1.0.0-beta.12.

CWE	CWE-863
Vendor	rustfs
Product	rustfs
Published	Aug 12, 2026
Last Updated	Aug 12, 2026

Stay Ahead of the Next One

Get instant alerts for rustfs rustfs

Be the first to know when new medium vulnerabilities affecting rustfs rustfs are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

rustfs / rustfs

< 1.0.0-beta.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rustfs/rustfs/security/advisories/GHSA-x298-9x87-fvjq github.com: https://github.com/rustfs/rustfs/commit/92f83bfe155d8a3b9cdd903086e5b28d52339efb github.com: https://github.com/rustfs/rustfs/releases/tag/1.0.0-beta.12