CVE-2026-40937

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rustfs/src/admin/handlers/event.rs` use a `check_permissions` helper that validates authentication only (access key + session token), without performing any admin-action authorization via `validate_admin_request`. Every other admin handler in the codebase correctly calls `validate_admin_request` with a specific `AdminAction`. This is the only admin handler file that skips authorization. A non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attacker-controlled endpoint. This enables cross-user event interception and audit evasion. 1.0.0-alpha.94 contains a patch.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.94	Product Release Notes
https://github.com/rustfs/rustfs/security/advisories/GHSA-pfcq-4gjr-6gjm	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha83::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha84::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha85::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha86::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha87::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha88::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha89::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha90::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha91::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha92::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha93::::rust::*

History

24 Apr 2026, 13:12

Type	Values Removed	Values Added
References	~~() https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.94 -~~	() https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.94 - Product, Release Notes
References	~~() https://github.com/rustfs/rustfs/security/advisories/GHSA-pfcq-4gjr-6gjm -~~	() https://github.com/rustfs/rustfs/security/advisories/GHSA-pfcq-4gjr-6gjm - Mitigation, Vendor Advisory
First Time		Rustfs rustfs Rustfs
CPE		cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha87::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha84::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha89::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha91::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha85::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha93::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha83::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha90::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha92::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha86::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha88::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49::::rust::*

22 Apr 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-22 21:17

Updated : 2026-04-24 13:12

NVD link : CVE-2026-40937

Mitre link : CVE-2026-40937

CVE.ORG link : CVE-2026-40937

JSON object : View

Products Affected

rustfs

rustfs

CWE

CWE-862

Missing Authorization

8.3 /10