CVE-2026-73285
Received Received - Intake

RustFS Authorization Bypass via OPA Policy Tag Handling

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs_existing_object_tag incorrectly for PreparedIamMode::Opa, causing maybe_merge_object_tag_conditions to omit s3:ExistingObjectTag/* values and allowing authenticated users to bypass tag-based policy restrictions. This issue is fixed in version 1.0.0-rc.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-73285
EUVD
EUVD-2026-57229

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rustfs rustfs to 1.0.0-beta.12 (exc)
rustfs rustfs From 1.0.0-rc.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

RustFS is a distributed object storage system. Between versions 1.0.0-alpha.64 and 1.0.0-rc.1, an issue in the external OPA authorization plugin caused the system to incorrectly handle S3 object tags. Specifically, the PreparedIamAuth.needs_existing_object_tag setting was set incorrectly for PreparedIamMode::Opa, leading to the omission of s3:ExistingObjectTag/* values in policy checks. This allowed authenticated users to bypass tag-based policy restrictions.

Detection Guidance

To detect this vulnerability, check if your RustFS deployment uses the OPA policy plugin via RUSTFS_POLICY_PLUGIN_URL and if tag-based policies are configured. Verify if object tags are being omitted in authorization requests by inspecting logs or policy evaluation outputs.

Impact Analysis

This vulnerability allows authenticated users to bypass tag-based authorization policies. If your RustFS deployment uses the OPA plugin and relies on object tags for access control, attackers could access, modify, or delete objects they should not be able to. For example, users restricted from accessing objects tagged 'security=restricted' could still read them because the policy engine lacks the tag information.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations. If tag-based policies are used to enforce data protection measures, bypassing these policies may result in non-compliance, data breaches, or unauthorized exposure of protected health or personal information.

Mitigation Strategies

Upgrade RustFS to version 1.0.0-rc.1 or later to fix the issue. If upgrading is not immediately possible, disable the OPA policy plugin by removing or unsetting RUSTFS_POLICY_PLUGIN_URL to prevent tag-based policy bypasses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73285. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart