Description RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rustfs/src/admin/handlers/event.rs` use a `check_permissions` helper that validates authentication only (access key + session token), without performing any admin-action authorization via `validate_admin_request`. Every other admin handler in the codebase correctly calls `validate_admin_request` with a specific `AdminAction`. This is the only admin handler file that skips authorization. A non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attacker-controlled endpoint. This enables cross-user event interception and audit evasion. 1.0.0-alpha.94 contains a patch.
An authorization bypass vulnerability has been identified in RustFS, a distributed object storage system, in versions prior to 1.0.0-alpha.94. The issue arises in all four notification target admin API endpoints, which only validate authentication without proper admin-action authorization. This flaw allows non-admin users to overwrite shared admin-defined notification targets, redirecting bucket event deliveries to attacker-controlled endpoints. Such exploitation facilitates cross-user event interception and evasion of audit trails.
Users can upgrade to RustFS version 1.0.0-alpha.94 or later, where this vulnerability has been patched.
Show AI summary Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2026 Exploitation: NoneAutomatable: NoTechnical Impact: Total
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration Affected Products Product Versions rustfs rustfs 1.0.0 alpha1
1.0.0 alpha10
1.0.0 alpha11
1.0.0 alpha12
1.0.0 alpha13
1.0.0 alpha14
1.0.0 alpha15
1.0.0 alpha16
1.0.0 alpha17
1.0.0 alpha18
1.0.0 alpha19
1.0.0 alpha2
1.0.0 alpha20
1.0.0 alpha21
1.0.0 alpha22
1.0.0 alpha23
1.0.0 alpha24
1.0.0 alpha25
1.0.0 alpha26
1.0.0 alpha27
1.0.0 alpha28
1.0.0 alpha29
1.0.0 alpha3
1.0.0 alpha30
1.0.0 alpha31
1.0.0 alpha32
1.0.0 alpha33
1.0.0 alpha34
1.0.0 alpha35
1.0.0 alpha36
1.0.0 alpha37
1.0.0 alpha38
1.0.0 alpha39
1.0.0 alpha4
1.0.0 alpha40
1.0.0 alpha41
1.0.0 alpha42
1.0.0 alpha43
1.0.0 alpha44
1.0.0 alpha45
1.0.0 alpha46
1.0.0 alpha47
1.0.0 alpha48
1.0.0 alpha49
1.0.0 alpha5
1.0.0 alpha50
1.0.0 alpha51
1.0.0 alpha52
1.0.0 alpha53
1.0.0 alpha54
1.0.0 alpha55
1.0.0 alpha56
1.0.0 alpha57
1.0.0 alpha58
1.0.0 alpha59
1.0.0 alpha6
1.0.0 alpha60
1.0.0 alpha61
1.0.0 alpha62
1.0.0 alpha63
1.0.0 alpha64
1.0.0 alpha65
1.0.0 alpha66
1.0.0 alpha67
1.0.0 alpha68
1.0.0 alpha69
1.0.0 alpha7
1.0.0 alpha70
1.0.0 alpha71
1.0.0 alpha72
1.0.0 alpha73
1.0.0 alpha74
1.0.0 alpha75
1.0.0 alpha76
1.0.0 alpha77
1.0.0 alpha78
1.0.0 alpha79
1.0.0 alpha8
1.0.0 alpha80
1.0.0 alpha81
1.0.0 alpha82
1.0.0 alpha83
1.0.0 alpha84
1.0.0 alpha85
1.0.0 alpha86
1.0.0 alpha87
1.0.0 alpha88
1.0.0 alpha89
1.0.0 alpha9
1.0.0 alpha90
1.0.0 alpha91
1.0.0 alpha92
1.0.0 alpha93
Viewing 5 of 93 versions. View all CPE cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha83:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha84:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha85:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha86:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha87:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha88:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha89:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha90:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha91:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha92:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha93:*:*:*:rust:*:* Remediation No remediation found in references.
Change History 4 change records found show changes