RustFS is a distributed object storage system built in Rust. Prior to alpha.90, RustFS contains a missing authorization check in the multipart copy path (UploadPartCopy). A low-privileged user who cannot read objects from a victim bucket can still exfiltrate victim objects by copying them into an attacker-controlled multipart upload and completing the upload. This breaks tenant isolation in multi-user / multi-tenant deployments. This vulnerability is fixed in alpha.90.
References
| Link | Resource |
|---|---|
| https://github.com/rustfs/rustfs/security/advisories/GHSA-mx42-j6wv-px98 | Exploit Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
10 Apr 2026, 19:03
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Rustfs rustfs
Rustfs |
|
| CPE | cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha87:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha84:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha89:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha85:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha83:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha86:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha88:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| References | () https://github.com/rustfs/rustfs/security/advisories/GHSA-mx42-j6wv-px98 - Exploit, Vendor Advisory |
07 Apr 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-07 19:16
Updated : 2026-04-10 19:03
NVD link : CVE-2026-39360
Mitre link : CVE-2026-39360
CVE.ORG link : CVE-2026-39360
JSON object : View
Products Affected
rustfs
- rustfs
CWE
CWE-862
Missing Authorization