CVE-2026-45042 Details
Description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper authorization in the UploadPartCopy operation allows copying objects across buckets without enforcing destination bucket restrictions on allowed copy sources. The implementation validates GetObject permission on the source bucket and PutObject on the destination bucket independently, but does not enforce any policy constraints on whether the destination bucket permits the specified copy source. This enables unauthorized cross-bucket data movement. This vulnerability is fixed in 1.0.0-beta.2.
A vulnerability in RustFS versions prior to 1.0.0-beta.2 allows improper authorization in the UploadPartCopy operation, enabling unauthorized copying of objects across buckets. The issue arises because the implementation independently validates permissions for accessing objects in the source bucket and for uploading objects to the destination bucket, without enforcing any policy constraints on whether the destination bucket allows the specified copy source. This flaw facilitates unauthorized cross-bucket data movement, violating tenant isolation guarantees and allowing sensitive data to be staged into controlled buckets.
Users are advised to update to RustFS version 1.0.0-beta.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rustfs/rustfs/security/advisories/GHSA-wfxj-ph3v-7mjf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/rustfs/rustfs/security/advisories/GHSA-wfxj-ph3v-7mjf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| RustFS | < 1.0.0-beta.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |