CVE-2026-73287
Received Received - Intake

Unauthorized Bucket Creation in RustFS via FTPS

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by calling storage.create_bucket without authorize_operation for S3Action::CreateBucket, allowing authenticated FTPS users denied s3:CreateBucket to create buckets. This issue is fixed in version 1.0.0-beta.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-73287
EUVD
EUVD-2026-57232

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rustfs rustfs to 1.0.0-beta.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73287 is a vulnerability in RustFS's FTP/FTPS frontend where the MKD command bypasses IAM authorization for bucket creation. The issue occurs because the FtpsDriver::mkd() function does not perform an authorization check before calling storage.create_bucket(), unlike other FTP operations which do enforce authorization.

Detection Guidance

To detect this vulnerability, check if your RustFS instance is running a version prior to 1.0.0-beta.12. Verify the FTPS MKD command behavior by testing if authenticated users can create buckets despite IAM policies denying s3:CreateBucket permission. Monitor for unexpected bucket creation events in logs.

Impact Analysis

An authenticated FTP user can create a bucket via the MKD command even when their IAM policy explicitly denies the s3:CreateBucket permission. This allows unauthorized users to create buckets, potentially consuming namespace or storage resources.

Mitigation Strategies

Upgrade RustFS to version 1.0.0-beta.12 or later immediately. Review and enforce IAM policies to ensure no unauthorized bucket creation is possible. Monitor for any unauthorized bucket creation attempts and restrict FTPS access if necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73287. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart