CVE-2026-73289
Received Received - Intake

RustFS Policy Engine Access Control Bypass via String Qualifier Misinterpretation

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's semantics because crates/policy/src/policy/function/string.rs negates the aggregate result after eval or eval_like instead of negating each request-value predicate before quantification. Partially overlapping policy and request value sets can therefore make an Allow condition grant access to an excluded principal or make a Deny guardrail fail, including policies based on jwt:groups and jwt:roles; absent keys also receive the opposite ForAllValues: and ForAnyValue: behavior. This issue is fixed in version 1.0.0-beta.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-73289
EUVD
EUVD-2026-57234

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rustfs rustfs 1.0.0-beta.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

RustFS is a distributed object storage system. Prior to version 1.0.0-beta.12, it incorrectly handled negated string conditions in IAM and bucket policies when combined with ForAllValues and ForAnyValue qualifiers. The logic for these qualifiers was transposed during negation, causing ForAllValues:StringNotEquals to behave like ForAnyValue:StringNotEquals and vice versa. This led to incorrect policy evaluations where access denials could grant access and vice versa.

Impact Analysis

This vulnerability can allow unauthorized access to data or resources due to incorrect policy evaluations. Specifically, it may grant access to excluded principals or fail to deny access to unauthorized users. This impacts confidentiality and integrity as attackers could read or modify data they should not have access to.

Compliance Impact

This vulnerability could lead to violations of compliance standards like GDPR or HIPAA by allowing unauthorized access to sensitive data. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for protected health information. Incorrect policy evaluations may result in unauthorized data exposure, leading to legal and regulatory penalties.

Mitigation Strategies

Upgrade RustFS to version 1.0.0-beta.12 or later to fix the incorrect handling of negated string conditions in IAM and bucket policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart