CVE-2026-55188 Details
Description
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an authenticated user with no effective bucket or admin permissions can list remote replication target configuration for a bucket. Because the returned BucketTarget objects include remote target credentials, this can disclose replication access keys and secret keys. This vulnerability is fixed in 1.0.0-beta.9.
An authorization bypass vulnerability has been identified in RustFS, a distributed object storage system, within the bucket replication admin API. This issue affects RustFS versions 1.0.0-alpha.1 through 1.0.0-beta.8. The vulnerability arises in the ListRemoteTargetHandler, which is responsible for listing remote replication targets. The handler only verifies the existence of request credentials but fails to check whether the caller has the necessary replication or administrator permissions. Consequently, an authenticated user without effective bucket or admin permissions can access remote replication target configurations for a bucket. The exposed BucketTarget objects contain remote target credentials, potentially disclosing sensitive information such as replication access keys and secret keys.
Users should upgrade to RustFS version 1.0.0-beta.9 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rustfs/rustfs/security/advisories/GHSA-796f-j7xp-hwf4 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/rustfs/rustfs/security/advisories/GHSA-796f-j7xp-hwf4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| RustFS | >= 1.0.0-alpha.1, <= 1.0.0-beta.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 27, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |