Back to overview

CVE-2026-45042

HIGH Exploitation: PoC
7.1
CVSS 4.0
Description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper authorization in the UploadPartCopy operation allows copying objects across buckets without enforcing destination bucket restrictions on allowed copy sources. The implementation validates GetObject permission on the source bucket and PutObject on the destination bucket independently, but does not enforce any policy constraints on whether the destination bucket permits the specified copy source. This enables unauthorized cross-bucket data movement. This vulnerability is fixed in 1.0.0-beta.2.

Metadata

CVE ID
CVE-2026-45042
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-08 18:07 UTC
Published
2026-05-28 18:32 UTC
Last updated
2026-05-28 19:26 UTC
Primary CWE
CWE-863
CWE-863: Incorrect Authorization
Vendor / Product
rustfs / rustfs
Sources
cve.org  ·  NVD

Severity & Metrics

7.1 HIGH CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
rustfs rustfs — < 1.0.0-beta.2
Weakness (CWE)
CWESourceDescription
CWE-863 cna CWE-863: Incorrect Authorization
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.1 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References (1)
Back to overview