CVE-2026-46685 Details

A vulnerability in RustFS versions prior to 1.0.0-beta.2 allows for permissive cross-origin resource sharing (CORS) policies when the RUSTFS_CORS_ALLOWED_ORIGINS variable is unset. In these versions, the S3 listener's ConditionalCorsLayer reflects any request Origin value back as Access-Control-Allow-Origin, and also includes Access-Control-Allow-Credentials: true and Access-Control-Allow-Headers: * in responses, including preflight and error responses. This behavior creates a cross-domain policy that can be exploited by a browser visiting an attacker-controlled page, allowing credentialed cross-origin requests to be sent to a RustFS deployment. The response can be read if the victim's browser has saved HTTP Basic Auth credentials, reverse-proxy SSO cookies, or TLS client certificates for the RustFS origin.

Users can update to RustFS version 1.0.0-beta.2 or later, where this vulnerability is fixed. Until then, it's recommended to manually set RUSTFS_CORS_ALLOWED_ORIGINS to a list of trusted origins and avoid exposing RustFS endpoints to browsers that may carry ambient credentials for the RustFS origin.