CVE-2026-73290
Received Received - Intake

Anonymous Object Version Listing in RustFS

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy_allowed path applies deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets, so a bucket that permits anonymous listing can continue exposing version listings after an operator enables the public-access control. The bypass affects GET /<bucket>?versions= and can disclose object version metadata even though equivalent GetObject requests are denied. This issue is fixed in version 1.0.0-beta.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-73290
EUVD
EUVD-2026-57235

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rustfs rustfs to 1.0.0-beta.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in RustFS (versions <= 1.0.0-beta.11) allows anonymous users to bypass the RestrictPublicBuckets setting when listing object versions. The ListObjectVersions action, when not explicitly granted in the bucket policy, incorrectly falls back to checking for s3:ListBucket permission instead of enforcing the RestrictPublicBuckets setting. This bypasses critical security checks, allowing anonymous access to object version metadata even after RestrictPublicBuckets is enabled.

Detection Guidance

To detect this vulnerability, check if anonymous users can list object versions in your RustFS buckets. Use AWS CLI commands like 'aws s3api list-object-versions --bucket <bucket-name>' to test version listing access. If the command succeeds without authentication, the bucket may be vulnerable.

Impact Analysis

If you use RustFS versions <= 1.0.0-beta.11 with a bucket policy granting anonymous s3:ListBucket access, attackers could list object versions via GET /<bucket>?versions= even if RestrictPublicBuckets is enabled. This exposes metadata about stored objects, potentially revealing sensitive information about file names, versions, or storage patterns.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data confidentiality, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized exposure of object metadata may constitute a breach of confidentiality obligations under these regulations.

Mitigation Strategies

Upgrade RustFS to version 1.0.0-beta.12 or later. Review bucket policies to ensure anonymous s3:ListBucket access is not granted. Enable RestrictPublicBuckets and verify that version listings are blocked for anonymous users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73290. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart