CVE-2026-22042

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAction` instead of `ImportIAMAction`, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation. Version 1.0.0-alpha.79 fixes the issue.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:*

History

17 Jun 2026, 10:19

Type Values Removed Values Added
Summary
  • (es) RustFS es un sistema de almacenamiento de objetos distribuido construido en Rust. Antes de la versión 1.0.0-alpha.79, la API de administración 'ImportIam' valida los permisos usando 'ExportIAMAction' en lugar de 'ImportIAMAction', permitiendo que una entidad con permisos IAM solo de exportación realice operaciones de importación. Dado que la importación de datos IAM realiza acciones de escritura privilegiadas (creación/actualización de usuarios, grupos, políticas y cuentas de servicio), esto puede llevar a una modificación no autorizada de IAM y escalada de privilegios. La versión 1.0.0-alpha.79 corrige el problema.

15 Jan 2026, 21:11

Type Values Removed Values Added
CPE cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:*
First Time Rustfs rustfs
Rustfs
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.8
References () https://github.com/rustfs/rustfs/security/advisories/GHSA-vcwh-pff9-64cc - () https://github.com/rustfs/rustfs/security/advisories/GHSA-vcwh-pff9-64cc - Exploit, Vendor Advisory

08 Jan 2026, 16:16

Type Values Removed Values Added
References () https://github.com/rustfs/rustfs/security/advisories/GHSA-vcwh-pff9-64cc - () https://github.com/rustfs/rustfs/security/advisories/GHSA-vcwh-pff9-64cc -

08 Jan 2026, 15:15

Type Values Removed Values Added
New CVE

Information

Published : 2026-01-08 15:15

Updated : 2026-06-17 10:19


NVD link : CVE-2026-22042

Mitre link : CVE-2026-22042

CVE.ORG link : CVE-2026-22042


JSON object : View

Products Affected

rustfs

  • rustfs
CWE
CWE-285

Improper Authorization

CWE-863

Incorrect Authorization