Description RustFS is a distributed object storage system built in Rust. Prior to alpha.90, RustFS contains a missing authorization check in the multipart copy path (UploadPartCopy). A low-privileged user who cannot read objects from a victim bucket can still exfiltrate victim objects by copying them into an attacker-controlled multipart upload and completing the upload. This breaks tenant isolation in multi-user / multi-tenant deployments. This vulnerability is fixed in alpha.90.
A vulnerability in RustFS prior to version alpha.90 allows low-privileged users to exfiltrate objects from victim buckets by copying them into an attacker-controlled multipart upload. This issue arises from a missing authorization check in the multipart copy process, breaking tenant isolation in multi-user deployments. The vulnerability is present in all versions from commit '09ea11c13' through 'c1d5106acc3480c275a52344df84633bb6dcd8f0', and likely any releases containing those commits'
Users are advised to update to RustFS version alpha.90 or later, where this vulnerability has been fixed.
Show AI summary Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026 Exploitation: PocAutomatable: NoTechnical Impact: Partial
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration Affected Products Product Versions rustfs rustfs 1.0.0 alpha1
1.0.0 alpha10
1.0.0 alpha11
1.0.0 alpha12
1.0.0 alpha13
1.0.0 alpha14
1.0.0 alpha15
1.0.0 alpha16
1.0.0 alpha17
1.0.0 alpha18
1.0.0 alpha19
1.0.0 alpha2
1.0.0 alpha20
1.0.0 alpha21
1.0.0 alpha22
1.0.0 alpha23
1.0.0 alpha24
1.0.0 alpha25
1.0.0 alpha26
1.0.0 alpha27
1.0.0 alpha28
1.0.0 alpha29
1.0.0 alpha3
1.0.0 alpha30
1.0.0 alpha31
1.0.0 alpha32
1.0.0 alpha33
1.0.0 alpha34
1.0.0 alpha35
1.0.0 alpha36
1.0.0 alpha37
1.0.0 alpha38
1.0.0 alpha39
1.0.0 alpha4
1.0.0 alpha40
1.0.0 alpha41
1.0.0 alpha42
1.0.0 alpha43
1.0.0 alpha44
1.0.0 alpha45
1.0.0 alpha46
1.0.0 alpha47
1.0.0 alpha48
1.0.0 alpha49
1.0.0 alpha5
1.0.0 alpha50
1.0.0 alpha51
1.0.0 alpha52
1.0.0 alpha53
1.0.0 alpha54
1.0.0 alpha55
1.0.0 alpha56
1.0.0 alpha57
1.0.0 alpha58
1.0.0 alpha59
1.0.0 alpha6
1.0.0 alpha60
1.0.0 alpha61
1.0.0 alpha62
1.0.0 alpha63
1.0.0 alpha64
1.0.0 alpha65
1.0.0 alpha66
1.0.0 alpha67
1.0.0 alpha68
1.0.0 alpha69
1.0.0 alpha7
1.0.0 alpha70
1.0.0 alpha71
1.0.0 alpha72
1.0.0 alpha73
1.0.0 alpha74
1.0.0 alpha75
1.0.0 alpha76
1.0.0 alpha77
1.0.0 alpha78
1.0.0 alpha79
1.0.0 alpha8
1.0.0 alpha80
1.0.0 alpha81
1.0.0 alpha82
1.0.0 alpha83
1.0.0 alpha84
1.0.0 alpha85
1.0.0 alpha86
1.0.0 alpha87
1.0.0 alpha88
1.0.0 alpha89
1.0.0 alpha9
Viewing 5 of 89 versions. View all CPE cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha83:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha84:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha85:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha86:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha87:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha88:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha89:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:* Remediation No remediation found in references.
Change History 5 change records found show changes