CVE-2026-73288
Received Received - Intake

RustFS Object Lock Bypass via Metadata Handling

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired. This issue is fixed in version 1.0.0-rc.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-73288
EUVD
EUVD-2026-57233

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rustfs rustfs to 1.0.0-rc.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

RustFS is a distributed object storage system. Prior to version 1.0.0-rc.1, its Object Lock enforcement incorrectly treated missing or unreadable bucket metadata as no lock configuration. This allowed objects under compliance retention to be deleted or expired, bypassing Write Once Read Many protections.

Detection Guidance

This vulnerability cannot be directly detected via network or system commands as it involves incorrect enforcement of Object Lock protections in RustFS due to metadata handling issues. The problem arises when bucket metadata is unreadable or corrupted, leading to false negatives in lock enforcement. Check RustFS version with 'rustfs --version' to confirm if you are running a vulnerable version (up to 1.0.0-beta.12).

Review logs for failed metadata reads or unparseable configurations in RustFS logs. Look for errors related to .metadata.bin files or Object Lock enforcement failures during delete operations.

Impact Analysis

This vulnerability can lead to irreversible loss of records that Object Lock was meant to retain. It affects operations like DeleteObject, lifecycle sweeps, and background scans, especially during events like drive replacements or metadata corruption.

Compliance Impact

The vulnerability can cause non-compliance with regulations requiring retention like SEC 17a-4(f), FINRA 4511, or CFTC 1.31. Objects under compliance-mode retention may be deleted, violating data retention policies in environments like GDPR or HIPAA.

Mitigation Strategies

Upgrade RustFS to version 1.0.0-rc.1 or later immediately to address the Object Lock enforcement flaw. This version ensures enforcement points fail closed when metadata is unreadable or unparseable.

Verify all Object Lock-protected objects are retained after upgrade by auditing compliance retention policies and testing delete operations on sample objects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73288. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart