CVE-2026-73284
Received Received - Intake

RustFS Service Account Privilege Escalation via Target User Manipulation

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/service_account.rs accepts an attacker-controlled target_user after only checking CreateServiceAccountAdminAction, passes it to new_service_account, and prepare_service_account_auth sets is_owner for the resulting root-parent service account. This issue is fixed in version 1.0.0-beta.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-73284
EUVD
EUVD-2026-57228

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rustfs rustfs to 1.0.0-beta.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a privilege escalation vulnerability in RustFS, a distributed object storage system. It allows an attacker with limited admin privileges to create a service account parented to the root user, granting full owner-level permissions. The flaw exists because the AddServiceAccount handler does not validate if a user can create service accounts under a specified target user, only checking for the CreateServiceAccountAdminAction permission.

Detection Guidance

Detecting this vulnerability requires checking RustFS versions prior to 1.0.0-beta.11 and verifying if service accounts with root as parent exist. Inspect logs for Admin API requests creating service accounts with target_user set to root. Use commands like 'rustfs admin list-service-accounts' to list accounts and check parent relationships.

Impact Analysis

An attacker could gain full control over the RustFS system, including read/write access to all storage buckets, IAM control, KMS management, and system configuration modification. This could lead to data theft, unauthorized access, or system disruption. Exploitation requires knowledge of the root user's access key and access to the Admin API endpoint.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and privacy such as GDPR and HIPAA. Full system compromise may result in data breaches, unauthorized modifications, or loss of auditability, all of which are critical compliance failures.

Mitigation Strategies

Upgrade RustFS to version 1.0.0-beta.11 or later immediately. Review and remove any service accounts with root as parent. Restrict access to the Admin API endpoint. Audit IAM policies and revoke unauthorized permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73284. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart